GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-02 11:25:50
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Burt\LOCALS~1\Temp\kwdorkod.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwCreateKey [0x9855BD72]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwCreateProcess [0x9853C9A6]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwCreateProcessEx [0x9853CB98]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwDeleteKey [0x9855C568]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwDeleteValueKey [0x9855C820]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwOpenKey [0x9855AA80]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwRenameKey [0x9855CC8A]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwSetValueKey [0x9855C036]
SSDT            \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                     ZwTerminateProcess [0x9853C656]

Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwCreateFile [0x9A0FC78A]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwCreateProcess [0x9A0FC738]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwCreateProcessEx [0x9A0FC74C]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwDeleteKey [0x9A0FC837]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwDeleteValueKey [0x9A0FC863]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwEnumerateKey [0x9A0FC8D1]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwEnumerateValueKey [0x9A0FC8BB]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwMapViewOfSection [0x9A0FC7CA]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwNotifyChangeKey [0x9A0FC8FD]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwOpenKey [0x9A0FC80D]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwOpenProcess [0x9A0FC710]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwOpenThread [0x9A0FC724]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwProtectVirtualMemory [0x9A0FC79E]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwQueryKey [0x9A0FC939]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwQueryMultipleValueKey [0x9A0FC8A5]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwQueryValueKey [0x9A0FC88F]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwRenameKey [0x9A0FC84D]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwReplaceKey [0x9A0FC925]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwRestoreKey [0x9A0FC911]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwSetContextThread [0x9A0FC776]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwSetInformationProcess [0x9A0FC762]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwTerminateProcess [0x9A0FC7F9]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwUnloadKey [0x9A0FC8E7]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwUnmapViewOfSection [0x9A0FC7E0]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     ZwYieldExecution [0x9A0FC7B4]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     NtCreateFile
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     NtMapViewOfSection
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     NtOpenProcess
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     NtOpenThread
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                     NtSetInformationProcess

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwYieldExecution                                                                                    80504AE8 7 Bytes  JMP 9A0FC7B8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!NtCreateFile                                                                                        80579084 5 Bytes  JMP 9A0FC78E \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!NtMapViewOfSection                                                                                  805B2004 7 Bytes  JMP 9A0FC7CE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwUnmapViewOfSection                                                                                805B2E12 5 Bytes  JMP 9A0FC7E4 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwProtectVirtualMemory                                                                              805B83E8 7 Bytes  JMP 9A0FC7A2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!NtOpenProcess                                                                                       805CB40A 5 Bytes  JMP 9A0FC714 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!NtOpenThread                                                                                        805CB696 5 Bytes  JMP 9A0FC728 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!NtSetInformationProcess                                                                             805CDE54 5 Bytes  JMP 9A0FC766 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwCreateProcessEx                                                                                   805D1144 7 Bytes  JMP 9A0FC750 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwCreateProcess                                                                                     805D11FA 5 Bytes  JMP 9A0FC73C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwSetContextThread                                                                                  805D1704 5 Bytes  JMP 9A0FC77A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwTerminateProcess                                                                                  805D29AC 5 Bytes  JMP 9A0FC7FD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwQueryValueKey                                                                                     806219EA 7 Bytes  JMP 9A0FC893 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwUnloadKey                                                                                         80622062 7 Bytes  JMP 9A0FC8EB \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwQueryMultipleValueKey                                                                             80622900 7 Bytes  JMP 9A0FC8A9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwRenameKey                                                                                         806231D4 7 Bytes  JMP 9A0FC851 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwDeleteKey                                                                                         80623C42 7 Bytes  JMP 9A0FC83B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwDeleteValueKey                                                                                    80623E12 7 Bytes  JMP 9A0FC867 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwEnumerateKey                                                                                      80623FF2 7 Bytes  JMP 9A0FC8D5 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwEnumerateValueKey                                                                                 8062425C 7 Bytes  JMP 9A0FC8BF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwOpenKey                                                                                           80624B84 5 Bytes  JMP 9A0FC811 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwQueryKey                                                                                          80624EAA 7 Bytes  JMP 9A0FC93D \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwRestoreKey                                                                                        8062516A 5 Bytes  JMP 9A0FC915 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwReplaceKey                                                                                        8062585E 5 Bytes  JMP 9A0FC929 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE            ntkrnlpa.exe!ZwNotifyChangeKey                                                                                   80625978 5 Bytes  JMP 9A0FC901 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
?               C:\WINDOWS\system32\Drivers\mchInjDrv.sys                                                                        The system cannot find the file specified. !
.text           ntdll.dll!NtClose                                                                                                7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtClose + 4                                                                                            7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           ntdll.dll!NtCreateFile                                                                                           7C90D0AE 1 Byte  [FF]
.text           ntdll.dll!NtCreateFile                                                                                           7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtCreateFile + 4                                                                                       7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           ntdll.dll!NtCreateKey                                                                                            7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtCreateKey + 4                                                                                        7C90D0F2 2 Bytes  [05, 5F]
.text           ntdll.dll!NtCreateSection                                                                                        7C90D17E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtCreateSection + 4                                                                                    7C90D182 2 Bytes  [23, 5F]
.text           ntdll.dll!NtDeleteKey                                                                                            7C90D24E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtDeleteKey + 4                                                                                        7C90D252 2 Bytes  [0B, 5F]
.text           ntdll.dll!NtDeleteValueKey                                                                                       7C90D26E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtDeleteValueKey + 4                                                                                   7C90D272 2 Bytes  [11, 5F]
.text           ntdll.dll!NtRenameKey                                                                                            7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtRenameKey + 4                                                                                        7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           ntdll.dll!NtSetInformationFile                                                                                   7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtSetInformationFile + 4                                                                               7C90DC62 2 Bytes  [20, 5F]
.text           ntdll.dll!NtSetValueKey                                                                                          7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtSetValueKey + 4                                                                                      7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           ntdll.dll!NtTerminateProcess                                                                                     7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtTerminateProcess + 4                                                                                 7C90DE72 2 Bytes  [26, 5F]
.text           ntdll.dll!NtWriteFile                                                                                            7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtWriteFile + 4                                                                                        7C90DF82 2 Bytes  [1A, 5F]
.text           ntdll.dll!NtWriteFileGather                                                                                      7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtWriteFileGather + 4                                                                                  7C90DF92 2 Bytes  [1D, 5F]
.text           ntdll.dll!NtWriteVirtualMemory                                                                                   7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           ntdll.dll!NtWriteVirtualMemory + 4                                                                               7C90DFB2 2 Bytes  [29, 5F]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtClose                                            7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtClose + 4                                        7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtCreateFile                                       7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtCreateFile                                       7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtCreateFile + 4                                   7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtCreateKey                                        7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtCreateKey + 4                                    7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtCreateSection                                    7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtCreateSection + 4                                7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtDeleteKey                                        7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtDeleteKey + 4                                    7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtDeleteValueKey                                   7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtDeleteValueKey + 4                               7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtRenameKey                                        7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtRenameKey + 4                                    7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtSetInformationFile                               7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtSetInformationFile + 4                           7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtSetValueKey                                      7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtSetValueKey + 4                                  7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtTerminateProcess                                 7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtTerminateProcess + 4                             7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtWriteFile                                        7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtWriteFile + 4                                    7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtWriteFileGather                                  7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtWriteFileGather + 4                              7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtWriteVirtualMemory                               7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] ntdll.dll!NtWriteVirtualMemory + 4                           7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] kernel32.dll!LoadLibraryExW + C4                             7C801BB9 4 Bytes  CALL 00CC0001 
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] kernel32.dll!FreeLibrary + 15                                7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] USER32.dll!ChangeDisplaySettingsExA                          7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] USER32.dll!SetForegroundWindow                               7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] USER32.dll!SetWindowsHookExW                                 7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] USER32.dll!SetWindowPos                                      7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] USER32.dll!SetWindowPos + 4                                  7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] USER32.dll!SetWindowsHookExA                                 7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[168] USER32.dll!ChangeDisplaySettingsExW                          7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtClose                                     7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtClose + 4                                 7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtCreateFile                                7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtCreateFile                                7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtCreateFile + 4                            7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtCreateKey                                 7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtCreateKey + 4                             7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtCreateSection                             7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtCreateSection + 4                         7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtDeleteKey                                 7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtDeleteKey + 4                             7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtDeleteValueKey                            7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtDeleteValueKey + 4                        7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtRenameKey                                 7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtRenameKey + 4                             7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtSetInformationFile                        7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtSetInformationFile + 4                    7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtSetValueKey                               7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtSetValueKey + 4                           7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtTerminateProcess                          7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtTerminateProcess + 4                      7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtWriteFile                                 7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtWriteFile + 4                             7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtWriteFileGather                           7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtWriteFileGather + 4                       7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtWriteVirtualMemory                        7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] ntdll.dll!NtWriteVirtualMemory + 4                    7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] KERNEL32.dll!LoadLibraryExW + C4                      7C801BB9 4 Bytes  CALL 04F30001 
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] USER32.dll!ChangeDisplaySettingsExA                   7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] USER32.dll!SetForegroundWindow                        7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] USER32.dll!SetWindowsHookExW                          7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] USER32.dll!SetWindowPos                               7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] USER32.dll!SetWindowPos + 4                           7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] USER32.dll!SetWindowsHookExA                          7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[312] USER32.dll!ChangeDisplaySettingsExW                   7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 01080001 
.text           C:\WINDOWS\system32\AESTFltr.exe[428] USER32.dll!ChangeDisplaySettingsExA                                        7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\AESTFltr.exe[428] USER32.dll!SetForegroundWindow                                             7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\AESTFltr.exe[428] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\AESTFltr.exe[428] USER32.dll!SetWindowPos                                                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] USER32.dll!SetWindowPos + 4                                                7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\AESTFltr.exe[428] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\AESTFltr.exe[428] USER32.dll!ChangeDisplaySettingsExW                                        7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtClose                                                    7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtClose + 4                                                7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtCreateFile                                               7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtCreateFile                                               7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtCreateFile + 4                                           7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtCreateKey                                                7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtCreateKey + 4                                            7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtCreateSection                                            7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtCreateSection + 4                                        7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtDeleteKey                                                7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtDeleteKey + 4                                            7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtDeleteValueKey                                           7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtDeleteValueKey + 4                                       7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtRenameKey                                                7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtRenameKey + 4                                            7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtSetInformationFile                                       7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtSetInformationFile + 4                                   7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtSetValueKey                                              7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtSetValueKey + 4                                          7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtTerminateProcess                                         7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtTerminateProcess + 4                                     7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtWriteFile                                                7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtWriteFile + 4                                            7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtWriteFileGather                                          7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtWriteFileGather + 4                                      7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtWriteVirtualMemory                                       7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] ntdll.dll!NtWriteVirtualMemory + 4                                   7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] kernel32.dll!LoadLibraryExW + C4                                     7C801BB9 4 Bytes  CALL 01350001 
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] USER32.dll!SetWindowsHookExW                                         7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\McAfee\MPF\MPFSrv.exe[496] USER32.dll!SetWindowsHookExA                                         7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 01010001 
.text           C:\WINDOWS\system32\igfxtray.exe[508] USER32.dll!ChangeDisplaySettingsExA                                        7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\igfxtray.exe[508] USER32.dll!SetForegroundWindow                                             7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\igfxtray.exe[508] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\igfxtray.exe[508] USER32.dll!SetWindowPos                                                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxtray.exe[508] USER32.dll!SetWindowPos + 4                                                7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\igfxtray.exe[508] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\igfxtray.exe[508] USER32.dll!ChangeDisplaySettingsExW                                        7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtClose                                      7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtClose + 4                                  7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtCreateFile                                 7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtCreateFile                                 7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtCreateFile + 4                             7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtCreateKey                                  7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtCreateKey + 4                              7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtCreateSection                              7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtCreateSection + 4                          7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtDeleteKey                                  7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtDeleteKey + 4                              7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtDeleteValueKey                             7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtDeleteValueKey + 4                         7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtRenameKey                                  7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtRenameKey + 4                              7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtSetInformationFile                         7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtSetInformationFile + 4                     7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtSetValueKey                                7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtSetValueKey + 4                            7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtTerminateProcess                           7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtTerminateProcess + 4                       7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtWriteFile                                  7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtWriteFile + 4                              7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtWriteFileGather                            7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtWriteFileGather + 4                        7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtWriteVirtualMemory                         7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] ntdll.dll!NtWriteVirtualMemory + 4                     7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] kernel32.dll!LoadLibraryExW + C4                       7C801BB9 4 Bytes  CALL 01E90001 
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] USER32.dll!SetWindowsHookExW                           7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe[532] USER32.dll!SetWindowsHookExA                           7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtClose                                                             7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtClose + 4                                                         7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtCreateFile                                                        7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtCreateFile                                                        7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtCreateFile + 4                                                    7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtCreateKey                                                         7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtCreateKey + 4                                                     7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtCreateSection                                                     7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtCreateSection + 4                                                 7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtDeleteKey                                                         7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtDeleteKey + 4                                                     7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtDeleteValueKey                                                    7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtDeleteValueKey + 4                                                7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtRenameKey                                                         7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtRenameKey + 4                                                     7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtSetInformationFile                                                7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtSetInformationFile + 4                                            7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtSetValueKey                                                       7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtSetValueKey + 4                                                   7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtTerminateProcess                                                  7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtTerminateProcess + 4                                              7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtWriteFile                                                         7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtWriteFile + 4                                                     7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtWriteFileGather                                                   7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtWriteFileGather + 4                                               7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtWriteVirtualMemory                                                7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] ntdll.dll!NtWriteVirtualMemory + 4                                            7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] kernel32.dll!LoadLibraryExW + C4                                              7C801BB9 4 Bytes  CALL 00F00001 
.text           C:\WINDOWS\system32\hkcmd.exe[540] USER32.dll!ChangeDisplaySettingsExA                                           7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\hkcmd.exe[540] USER32.dll!SetForegroundWindow                                                7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\hkcmd.exe[540] USER32.dll!SetWindowsHookExW                                                  7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\hkcmd.exe[540] USER32.dll!SetWindowPos                                                       7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\hkcmd.exe[540] USER32.dll!SetWindowPos + 4                                                   7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\hkcmd.exe[540] USER32.dll!SetWindowsHookExA                                                  7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\hkcmd.exe[540] USER32.dll!ChangeDisplaySettingsExW                                           7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtClose                                                  7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtClose + 4                                              7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtCreateFile                                             7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtCreateFile                                             7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtCreateFile + 4                                         7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtCreateKey                                              7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtCreateKey + 4                                          7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtCreateSection                                          7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtCreateSection + 4                                      7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtDeleteKey                                              7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtDeleteKey + 4                                          7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtDeleteValueKey                                         7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtDeleteValueKey + 4                                     7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtRenameKey                                              7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtRenameKey + 4                                          7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtSetInformationFile                                     7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtSetInformationFile + 4                                 7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtSetValueKey                                            7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtSetValueKey + 4                                        7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtTerminateProcess                                       7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtTerminateProcess + 4                                   7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtWriteFile                                              7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtWriteFile + 4                                          7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtWriteFileGather                                        7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtWriteFileGather + 4                                    7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtWriteVirtualMemory                                     7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] ntdll.dll!NtWriteVirtualMemory + 4                                 7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] kernel32.dll!LoadLibraryExW + C4                                   7C801BB9 4 Bytes  CALL 01790001 
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] USER32.dll!SetWindowsHookExW                                       7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\McAfee\MSK\MskSrver.exe[548] USER32.dll!SetWindowsHookExA                                       7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 00FB0001 
.text           C:\WINDOWS\system32\igfxpers.exe[552] USER32.dll!ChangeDisplaySettingsExA                                        7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\igfxpers.exe[552] USER32.dll!SetForegroundWindow                                             7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\igfxpers.exe[552] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\igfxpers.exe[552] USER32.dll!SetWindowPos                                                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxpers.exe[552] USER32.dll!SetWindowPos + 4                                                7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\igfxpers.exe[552] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\igfxpers.exe[552] USER32.dll!ChangeDisplaySettingsExW                                        7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtClose                                               7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtClose + 4                                           7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtCreateFile                                          7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtCreateFile                                          7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtCreateFile + 4                                      7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtCreateKey                                           7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtCreateKey + 4                                       7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtCreateSection                                       7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtCreateSection + 4                                   7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtDeleteKey                                           7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtDeleteKey + 4                                       7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtDeleteValueKey                                      7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtDeleteValueKey + 4                                  7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtRenameKey                                           7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtRenameKey + 4                                       7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtSetInformationFile                                  7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtSetInformationFile + 4                              7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtSetValueKey                                         7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtSetValueKey + 4                                     7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtTerminateProcess                                    7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtTerminateProcess + 4                                7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtWriteFile                                           7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtWriteFile + 4                                       7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtWriteFileGather                                     7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtWriteFileGather + 4                                 7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtWriteVirtualMemory                                  7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] ntdll.dll!NtWriteVirtualMemory + 4                              7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] kernel32.dll!LoadLibraryExW + C4                                7C801BB9 4 Bytes  CALL 01C60001 
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] USER32.dll!ChangeDisplaySettingsExA                             7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] USER32.dll!SetForegroundWindow                                  7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] USER32.dll!SetWindowsHookExW                                    7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] USER32.dll!SetWindowPos                                         7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] USER32.dll!SetWindowPos + 4                                     7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] USER32.dll!SetWindowsHookExA                                    7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Dell\QuickSet\quickset.exe[572] USER32.dll!ChangeDisplaySettingsExW                             7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtClose                                      7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtClose + 4                                  7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtCreateFile                                 7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtCreateFile                                 7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtCreateFile + 4                             7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtCreateKey                                  7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtCreateKey + 4                              7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtCreateSection                              7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtCreateSection + 4                          7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtDeleteKey                                  7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtDeleteKey + 4                              7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtDeleteValueKey                             7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtDeleteValueKey + 4                         7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtRenameKey                                  7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtRenameKey + 4                              7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtSetInformationFile                         7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtSetInformationFile + 4                     7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtSetValueKey                                7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtSetValueKey + 4                            7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtTerminateProcess                           7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtTerminateProcess + 4                       7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtWriteFile                                  7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtWriteFile + 4                              7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtWriteFileGather                            7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtWriteFileGather + 4                        7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtWriteVirtualMemory                         7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] ntdll.dll!NtWriteVirtualMemory + 4                     7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] kernel32.dll!LoadLibraryExW + C4                       7C801BB9 4 Bytes  CALL 00F70001 
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] USER32.dll!ChangeDisplaySettingsExA                    7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] USER32.dll!SetForegroundWindow                         7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] USER32.dll!SetWindowsHookExW                           7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] USER32.dll!SetWindowPos                                7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] USER32.dll!SetWindowPos + 4                            7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] USER32.dll!SetWindowsHookExA                           7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[672] USER32.dll!ChangeDisplaySettingsExW                    7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtClose                                           7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtClose + 4                                       7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtCreateFile                                      7C90D0AE 1 Byte  [FF]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtCreateFile                                      7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtCreateFile + 4                                  7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtCreateKey                                       7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtCreateKey + 4                                   7C90D0F2 2 Bytes  [05, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtCreateSection                                   7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtCreateSection + 4                               7C90D182 2 Bytes  [23, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtDeleteKey                                       7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtDeleteKey + 4                                   7C90D252 2 Bytes  [0B, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtDeleteValueKey                                  7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtDeleteValueKey + 4                              7C90D272 2 Bytes  [11, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtRenameKey                                       7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtRenameKey + 4                                   7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtSetInformationFile                              7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtSetInformationFile + 4                          7C90DC62 2 Bytes  [20, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtSetValueKey                                     7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtSetValueKey + 4                                 7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtTerminateProcess                                7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtTerminateProcess + 4                            7C90DE72 2 Bytes  [26, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtWriteFile                                       7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtWriteFile + 4                                   7C90DF82 2 Bytes  [1A, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtWriteFileGather                                 7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtWriteFileGather + 4                             7C90DF92 2 Bytes  [1D, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtWriteVirtualMemory                              7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] ntdll.dll!NtWriteVirtualMemory + 4                          7C90DFB2 2 Bytes  [29, 5F]
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] kernel32.dll!LoadLibraryExW + C4                            7C801BB9 4 Bytes  CALL 02380001 
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] kernel32.dll!LoadLibraryA                                   7C801D7B 5 Bytes  JMP 0041C130 C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] kernel32.dll!LoadLibraryW                                   7C80AEEB 5 Bytes  JMP 0041C1B0 C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] USER32.dll!SetWindowsHookExW                                7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[744] USER32.dll!SetWindowsHookExA                                7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtClose                                                             7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtClose + 4                                                         7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtCreateFile                                                        7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtCreateFile                                                        7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtCreateFile + 4                                                    7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtCreateKey                                                         7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtCreateKey + 4                                                     7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtCreateSection                                                     7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtCreateSection + 4                                                 7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtDeleteKey                                                         7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtDeleteKey + 4                                                     7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtDeleteValueKey                                                    7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtDeleteValueKey + 4                                                7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtRenameKey                                                         7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtRenameKey + 4                                                     7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtSetInformationFile                                                7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtSetInformationFile + 4                                            7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtSetValueKey                                                       7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtSetValueKey + 4                                                   7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtTerminateProcess                                                  7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtTerminateProcess + 4                                              7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtWriteFile                                                         7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtWriteFile + 4                                                     7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtWriteFileGather                                                   7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtWriteFileGather + 4                                               7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtWriteVirtualMemory                                                7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\csrss.exe[760] ntdll.dll!NtWriteVirtualMemory + 4                                            7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\csrss.exe[760] KERNEL32.dll!LoadLibraryExW + C4                                              7C801BB9 4 Bytes  CALL 012C0001 
.text           C:\WINDOWS\system32\csrss.exe[760] USER32.dll!SetWindowsHookExW                                                  7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\csrss.exe[760] USER32.dll!SetWindowsHookExA                                                  7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[788] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 00FE0001 
.text           C:\WINDOWS\system32\winlogon.exe[788] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\winlogon.exe[788] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[832] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 012A0FE5 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 012A0F30 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 012A0F41 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 012A0F5E 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 012A001B 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 012A0000 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 012A0F04 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 012A0F15 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 012A0EC7 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 012A0EE2 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 012A0EAC 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 012A0F79 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 012A0FCA 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 012A0040 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 012A0F94 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 012A0FB9 
.text           C:\WINDOWS\system32\services.exe[832] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 012A0EF3 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 00FF0FD4 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 00FF0F94 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 00FF0FE5 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 00FF0011 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 00FF0051 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 00FF0000 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 2 Bytes  JMP 00FF0FB9 
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegCreateKeyW + 3                                             77DFBA58 2 Bytes  [1F, 89]
.text           C:\WINDOWS\system32\services.exe[832] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 00FF0040 
.text           C:\WINDOWS\system32\services.exe[832] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 00FE003D 
.text           C:\WINDOWS\system32\services.exe[832] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 00FE0FB2 
.text           C:\WINDOWS\system32\services.exe[832] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 00FE0022 
.text           C:\WINDOWS\system32\services.exe[832] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 00FE0000 
.text           C:\WINDOWS\system32\services.exe[832] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 00FE0FCD 
.text           C:\WINDOWS\system32\services.exe[832] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 00FE0011 
.text           C:\WINDOWS\system32\services.exe[832] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\services.exe[832] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\services.exe[832] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 00FD0000 
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtClose                                                             7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtClose + 4                                                         7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtCreateFile                                                        7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtCreateFile                                                        7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtCreateFile + 4                                                    7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtCreateKey                                                         7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtCreateKey + 4                                                     7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtCreateSection                                                     7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtCreateSection + 4                                                 7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtDeleteKey                                                         7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtDeleteKey + 4                                                     7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtDeleteValueKey                                                    7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtDeleteValueKey + 4                                                7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtRenameKey                                                         7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtRenameKey + 4                                                     7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtSetInformationFile                                                7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtSetInformationFile + 4                                            7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtSetValueKey                                                       7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtSetValueKey + 4                                                   7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtTerminateProcess                                                  7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtTerminateProcess + 4                                              7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtWriteFile                                                         7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtWriteFile + 4                                                     7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtWriteFileGather                                                   7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtWriteFileGather + 4                                               7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtWriteVirtualMemory                                                7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[844] ntdll.dll!NtWriteVirtualMemory + 4                                            7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!CreateFileA                                                      7C801A28 5 Bytes  JMP 00F8000A 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!VirtualProtectEx                                                 7C801A61 5 Bytes  JMP 00F800B1 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!VirtualProtect                                                   7C801AD4 5 Bytes  JMP 00F80FB2 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!LoadLibraryExW                                                   7C801AF5 5 Bytes  JMP 00F80FC3 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!LoadLibraryExA                                                   7C801D53 5 Bytes  JMP 00F80FD4 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!LoadLibraryA                                                     7C801D7B 5 Bytes  JMP 00F80FE5 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!GetStartupInfoW                                                  7C801E54 5 Bytes  JMP 00F80F75 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!GetStartupInfoA                                                  7C801EF2 5 Bytes  JMP 00F80F86 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!CreateProcessW                                                   7C802336 5 Bytes  JMP 00F80F3F 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!CreateProcessA                                                   7C80236B 5 Bytes  JMP 00F800D8 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!GetProcAddress                                                   7C80AE40 5 Bytes  JMP 00F80F24 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!LoadLibraryW                                                     7C80AEEB 5 Bytes  JMP 00F80076 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!CreateFileW                                                      7C810800 5 Bytes  JMP 00F8001B 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!CreatePipe                                                       7C81D83F 5 Bytes  JMP 00F80F97 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!CreateNamedPipeW                                                 7C82F0DD 5 Bytes  JMP 00F80051 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!CreateNamedPipeA                                                 7C860CDC 5 Bytes  JMP 00F80036 
.text           C:\WINDOWS\system32\lsass.exe[844] kernel32.dll!WinExec                                                          7C86250D 5 Bytes  JMP 00F80F5A 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegOpenKeyExW                                                    77DD6AAF 5 Bytes  JMP 00F70FB9 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegCreateKeyExW                                                  77DD776C 5 Bytes  JMP 00F70058 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegOpenKeyExA                                                    77DD7852 5 Bytes  JMP 00F70FD4 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegOpenKeyW                                                      77DD7946 5 Bytes  JMP 00F7000A 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegCreateKeyExA                                                  77DDE9F4 5 Bytes  JMP 00F7003D 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegOpenKeyA                                                      77DDEFC8 5 Bytes  JMP 00F70FEF 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegCreateKeyW                                                    77DFBA55 5 Bytes  JMP 00F7002C 
.text           C:\WINDOWS\system32\lsass.exe[844] ADVAPI32.dll!RegCreateKeyA                                                    77DFBCF3 5 Bytes  JMP 00F7001B 
.text           C:\WINDOWS\system32\lsass.exe[844] USER32.dll!SetWindowsHookExW                                                  7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\lsass.exe[844] USER32.dll!SetWindowsHookExA                                                  7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\lsass.exe[844] msvcrt.dll!_wsystem                                                           77C2931E 5 Bytes  JMP 00F60F7C 
.text           C:\WINDOWS\system32\lsass.exe[844] msvcrt.dll!system                                                             77C293C7 5 Bytes  JMP 00F60FA1 
.text           C:\WINDOWS\system32\lsass.exe[844] msvcrt.dll!_creat                                                             77C2D40F 5 Bytes  JMP 00F60FCD 
.text           C:\WINDOWS\system32\lsass.exe[844] msvcrt.dll!_open                                                              77C2F566 5 Bytes  JMP 00F60000 
.text           C:\WINDOWS\system32\lsass.exe[844] msvcrt.dll!_wcreat                                                            77C2FC9B 5 Bytes  JMP 00F60FBC 
.text           C:\WINDOWS\system32\lsass.exe[844] msvcrt.dll!_wopen                                                             77C30055 5 Bytes  JMP 00F60011 
.text           C:\WINDOWS\system32\lsass.exe[844] WS2_32.dll!socket                                                             71AB4211 5 Bytes  JMP 00BD0000 
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtClose                                                                   7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtClose + 4                                                               7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtCreateFile                                                              7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtCreateFile                                                              7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtCreateFile + 4                                                          7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtCreateKey                                                               7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtCreateKey + 4                                                           7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtCreateSection                                                           7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtCreateSection + 4                                                       7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtDeleteKey                                                               7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtDeleteKey + 4                                                           7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtDeleteValueKey                                                          7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtDeleteValueKey + 4                                                      7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtRenameKey                                                               7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtRenameKey + 4                                                           7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtSetInformationFile                                                      7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtSetInformationFile + 4                                                  7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtSetValueKey                                                             7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtSetValueKey + 4                                                         7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtTerminateProcess                                                        7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtTerminateProcess + 4                                                    7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtWriteFile                                                               7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtWriteFile + 4                                                           7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtWriteFileGather                                                         7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtWriteFileGather + 4                                                     7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtWriteVirtualMemory                                                      7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[964] ntdll.dll!NtWriteVirtualMemory + 4                                                  7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!CreateFileA                                                            7C801A28 5 Bytes  JMP 02A10FEF 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!VirtualProtectEx                                                       7C801A61 5 Bytes  JMP 02A10F77 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!VirtualProtect                                                         7C801AD4 5 Bytes  JMP 02A10F88 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!LoadLibraryExW                                                         7C801AF5 5 Bytes  JMP 02A10062 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!LoadLibraryExA                                                         7C801D53 5 Bytes  JMP 02A10047 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!LoadLibraryA                                                           7C801D7B 5 Bytes  JMP 02A10FAF 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!GetStartupInfoW                                                        7C801E54 5 Bytes  JMP 02A10F4B 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!GetStartupInfoA                                                        7C801EF2 5 Bytes  JMP 02A10091 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!CreateProcessW                                                         7C802336 5 Bytes  JMP 02A10F1F 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!CreateProcessA                                                         7C80236B 5 Bytes  JMP 02A100B8 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!GetProcAddress                                                         7C80AE40 5 Bytes  JMP 02A10F04 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!LoadLibraryW                                                           7C80AEEB 5 Bytes  JMP 02A10036 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!CreateFileW                                                            7C810800 5 Bytes  JMP 02A1000A 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!CreatePipe                                                             7C81D83F 5 Bytes  JMP 02A10F66 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!CreateNamedPipeW                                                       7C82F0DD 5 Bytes  JMP 02A1001B 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!CreateNamedPipeA                                                       7C860CDC 5 Bytes  JMP 02A10FD4 
.text           C:\WINDOWS\Explorer.EXE[964] kernel32.dll!WinExec                                                                7C86250D 5 Bytes  JMP 02A10F3A 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegOpenKeyExW                                                          77DD6AAF 5 Bytes  JMP 0123003D 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegCreateKeyExW                                                        77DD776C 5 Bytes  JMP 01230F94 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegOpenKeyExA                                                          77DD7852 5 Bytes  JMP 0123002C 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegOpenKeyW                                                            77DD7946 5 Bytes  JMP 01230011 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegCreateKeyExA                                                        77DDE9F4 5 Bytes  JMP 01230FAF 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegOpenKeyA                                                            77DDEFC8 5 Bytes  JMP 01230000 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegCreateKeyW                                                          77DFBA55 2 Bytes  JMP 01230FC0 
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegCreateKeyW + 3                                                      77DFBA58 2 Bytes  [43, 89]
.text           C:\WINDOWS\Explorer.EXE[964] ADVAPI32.dll!RegCreateKeyA                                                          77DFBCF3 5 Bytes  JMP 01230FDB 
.text           C:\WINDOWS\Explorer.EXE[964] USER32.dll!SetWindowsHookExW                                                        7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\Explorer.EXE[964] USER32.dll!SetWindowsHookExA                                                        7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\Explorer.EXE[964] msvcrt.dll!_wsystem                                                                 77C2931E 5 Bytes  JMP 01220025 
.text           C:\WINDOWS\Explorer.EXE[964] msvcrt.dll!system                                                                   77C293C7 5 Bytes  JMP 01220F9A 
.text           C:\WINDOWS\Explorer.EXE[964] msvcrt.dll!_creat                                                                   77C2D40F 5 Bytes  JMP 01220000 
.text           C:\WINDOWS\Explorer.EXE[964] msvcrt.dll!_open                                                                    77C2F566 5 Bytes  JMP 01220FEF 
.text           C:\WINDOWS\Explorer.EXE[964] msvcrt.dll!_wcreat                                                                  77C2FC9B 5 Bytes  JMP 01220FB5 
.text           C:\WINDOWS\Explorer.EXE[964] msvcrt.dll!_wopen                                                                   77C30055 5 Bytes  JMP 01220FD2 
.text           C:\WINDOWS\Explorer.EXE[964] WININET.dll!InternetOpenA                                                           3D95D690 5 Bytes  JMP 0120000A 
.text           C:\WINDOWS\Explorer.EXE[964] WININET.dll!InternetOpenW                                                           3D95DB09 5 Bytes  JMP 0120001B 
.text           C:\WINDOWS\Explorer.EXE[964] WININET.dll!InternetOpenUrlA                                                        3D95F3A4 5 Bytes  JMP 0120002C 
.text           C:\WINDOWS\Explorer.EXE[964] WININET.dll!InternetOpenUrlW                                                        3D9A6DDF 5 Bytes  JMP 01200FE5 
.text           C:\WINDOWS\Explorer.EXE[964] WS2_32.dll!socket                                                                   71AB4211 5 Bytes  JMP 01210FEF 
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1016] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 02560FE5 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 02560062 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 02560051 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 02560F77 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 02560F94 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 02560FB9 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 02560F2B 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 02560F48 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 02560EF5 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 0256008E 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 02560ED0 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 02560036 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 02560FD4 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 02560073 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 02560025 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 0256000A 
.text           C:\WINDOWS\system32\svchost.exe[1016] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 02560F10 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 02440FCD 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 0244005E 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 02440FDE 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 02440FEF 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 02440043 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 02440000 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 2 Bytes  JMP 02440FA1 
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyW + 3                                             77DFBA58 2 Bytes  [64, 8A]
.text           C:\WINDOWS\system32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 02440FB2 
.text           C:\WINDOWS\system32\svchost.exe[1016] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\svchost.exe[1016] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1016] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 02430F9A 
.text           C:\WINDOWS\system32\svchost.exe[1016] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 02430FAB 
.text           C:\WINDOWS\system32\svchost.exe[1016] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 02430FCD 
.text           C:\WINDOWS\system32\svchost.exe[1016] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 02430FEF 
.text           C:\WINDOWS\system32\svchost.exe[1016] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 02430FBC 
.text           C:\WINDOWS\system32\svchost.exe[1016] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 02430FDE 
.text           C:\WINDOWS\system32\svchost.exe[1016] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 02420FEF 
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1084] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 00FF0000 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 00FF009B 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00FF0F9C 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 00FF0FAD 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 00FF0076 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 00FF004A 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 00FF00D1 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 00FF0F8B 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 00FF0F53 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 00FF0F6E 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 00FF0111 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 00FF005B 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 00FF0FEF 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 00FF00AC 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 00FF0FD4 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 00FF0025 
.text           C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 00FF00E2 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 00FE0FCA 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 00FE0091 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 00FE0FE5 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 00FE001B 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 00FE0076 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 00FE0000 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 5 Bytes  JMP 00FE0051 
.text           C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 00FE0040 
.text           C:\WINDOWS\system32\svchost.exe[1084] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\svchost.exe[1084] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1084] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 00FD0067 
.text           C:\WINDOWS\system32\svchost.exe[1084] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 00FD0FD2 
.text           C:\WINDOWS\system32\svchost.exe[1084] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 00FD001D 
.text           C:\WINDOWS\system32\svchost.exe[1084] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 00FD0000 
.text           C:\WINDOWS\system32\svchost.exe[1084] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 00FD0038 
.text           C:\WINDOWS\system32\svchost.exe[1084] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 00FD0FE3 
.text           C:\WINDOWS\system32\svchost.exe[1084] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 00FC0000 
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtClose                                              7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtClose + 4                                          7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtCreateFile                                         7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtCreateFile                                         7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtCreateFile + 4                                     7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtCreateKey                                          7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtCreateKey + 4                                      7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtCreateSection                                      7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtCreateSection + 4                                  7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtDeleteKey                                          7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtDeleteKey + 4                                      7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtDeleteValueKey                                     7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtDeleteValueKey + 4                                 7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtRenameKey                                          7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtRenameKey + 4                                      7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtSetInformationFile                                 7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtSetInformationFile + 4                             7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtSetValueKey                                        7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtSetValueKey + 4                                    7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtTerminateProcess                                   7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtTerminateProcess + 4                               7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtWriteFile                                          7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtWriteFile + 4                                      7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtWriteFileGather                                    7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtWriteFileGather + 4                                7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtWriteVirtualMemory                                 7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] ntdll.dll!NtWriteVirtualMemory + 4                             7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] KERNEL32.dll!LoadLibraryExW + C4                               7C801BB9 4 Bytes  CALL 062B0001 
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] USER32.dll!ChangeDisplaySettingsExA                            7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] USER32.dll!SetForegroundWindow                                 7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] USER32.dll!SetWindowsHookExW                                   7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] USER32.dll!SetWindowPos                                        7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] USER32.dll!SetWindowPos + 4                                    7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] USER32.dll!SetWindowsHookExA                                   7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Dell\DellDock\DellDock.exe[1124] USER32.dll!ChangeDisplaySettingsExW                            7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtClose                                             7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtClose + 4                                         7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtCreateFile                                        7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtCreateFile                                        7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtCreateFile + 4                                    7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtCreateKey                                         7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtCreateKey + 4                                     7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtCreateSection                                     7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtCreateSection + 4                                 7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtDeleteKey                                         7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtDeleteKey + 4                                     7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtDeleteValueKey                                    7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtDeleteValueKey + 4                                7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtRenameKey                                         7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtRenameKey + 4                                     7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtSetInformationFile                                7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtSetInformationFile + 4                            7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtSetValueKey                                       7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtSetValueKey + 4                                   7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtTerminateProcess                                  7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtTerminateProcess + 4                              7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtWriteFile                                         7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtWriteFile + 4                                     7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtWriteFileGather                                   7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtWriteFileGather + 4                               7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtWriteVirtualMemory                                7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] ntdll.dll!NtWriteVirtualMemory + 4                            7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] kernel32.dll!LoadLibraryExW + C4                              7C801BB9 4 Bytes  CALL 00B40001 
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] USER32.dll!SetWindowsHookExW                                  7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Dell\DellDock\DockLogin.exe[1180] USER32.dll!SetWindowsHookExA                                  7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1192] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 03700FE5 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 0370006C 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 03700F77 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 03700051 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 03700F94 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 03700011 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 03700F4B 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 03700093 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 037000E4 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 037000C9 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 03700F26 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 0370002C 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 03700FD4 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 03700F5C 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 03700FA5 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 03700000 
.text           C:\WINDOWS\System32\svchost.exe[1192] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 037000B8 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 036F002C 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 036F0084 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 036F0011 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 036F0000 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 036F0073 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 036F0FEF 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 5 Bytes  JMP 036F0058 
.text           C:\WINDOWS\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 036F003D 
.text           C:\WINDOWS\System32\svchost.exe[1192] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\System32\svchost.exe[1192] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1192] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 036E0FAF 
.text           C:\WINDOWS\System32\svchost.exe[1192] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 036E0FD4 
.text           C:\WINDOWS\System32\svchost.exe[1192] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 036E0029 
.text           C:\WINDOWS\System32\svchost.exe[1192] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 036E0FEF 
.text           C:\WINDOWS\System32\svchost.exe[1192] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 036E0044 
.text           C:\WINDOWS\System32\svchost.exe[1192] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 036E0018 
.text           C:\WINDOWS\System32\svchost.exe[1192] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 036D0000 
.text           C:\WINDOWS\System32\svchost.exe[1192] WININET.dll!InternetOpenA                                                  3D95D690 5 Bytes  JMP 02CE0FEF 
.text           C:\WINDOWS\System32\svchost.exe[1192] WININET.dll!InternetOpenW                                                  3D95DB09 5 Bytes  JMP 02CE0FDE 
.text           C:\WINDOWS\System32\svchost.exe[1192] WININET.dll!InternetOpenUrlA                                               3D95F3A4 5 Bytes  JMP 02CE0FC3 
.text           C:\WINDOWS\System32\svchost.exe[1192] WININET.dll!InternetOpenUrlW                                               3D9A6DDF 5 Bytes  JMP 02CE000A 
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 00930FE5 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 00930F83 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00930082 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 00930F9E 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 00930FAF 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 00930FCA 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 00930F55 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 00930F66 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 009300EE 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 009300DD 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 00930109 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 00930051 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 0093000A 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 0093009D 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 00930040 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 00930025 
.text           C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 009300C2 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 00920047 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 00920098 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 0092002C 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 00920011 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 00920087 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 00920000 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 5 Bytes  JMP 00920062 
.text           C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 00920FE5 
.text           C:\WINDOWS\system32\svchost.exe[1288] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\svchost.exe[1288] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 0091002F 
.text           C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 00910FA4 
.text           C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 0091000A 
.text           C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 00910FE3 
.text           C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 00910FB5 
.text           C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 00910FD2 
.text           C:\WINDOWS\system32\svchost.exe[1288] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 00880FEF 
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtClose                                            7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtClose + 4                                        7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtCreateFile                                       7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtCreateFile                                       7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtCreateFile + 4                                   7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtCreateKey                                        7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtCreateKey + 4                                    7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtCreateSection                                    7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtCreateSection + 4                                7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtDeleteKey                                        7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtDeleteKey + 4                                    7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtDeleteValueKey                                   7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtDeleteValueKey + 4                               7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtRenameKey                                        7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtRenameKey + 4                                    7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtSetInformationFile                               7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtSetInformationFile + 4                           7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtSetValueKey                                      7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtSetValueKey + 4                                  7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtTerminateProcess                                 7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtTerminateProcess + 4                             7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtWriteFile                                        7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtWriteFile + 4                                    7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtWriteFileGather                                  7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtWriteFileGather + 4                              7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtWriteVirtualMemory                               7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] ntdll.dll!NtWriteVirtualMemory + 4                           7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] kernel32.dll!LoadLibraryExW + C4                             7C801BB9 4 Bytes  CALL 01630001 
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] USER32.dll!ChangeDisplaySettingsExA                          7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] USER32.dll!SetForegroundWindow                               7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] USER32.dll!SetWindowsHookExW                                 7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] USER32.dll!SetWindowPos                                      7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] USER32.dll!SetWindowPos + 4                                  7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] USER32.dll!SetWindowsHookExA                                 7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\McAfee.com\Agent\mcagent.exe[1308] USER32.dll!ChangeDisplaySettingsExW                          7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 00B40FE5 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 00B40F79 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00B40F94 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 00B40062 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 00B40051 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 00B4002C 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 00B40F4D 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 00B40F5E 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 00B400D5 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 00B400C4 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 00B40F17 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 00B40FA5 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 00B40000 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 00B40089 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 00B40011 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 00B40FCA 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 00B40F3C 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 00B30FC0 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 00B30047 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 00B30011 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 00B30000 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 00B30F8A 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 00B30FE5 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 5 Bytes  JMP 00B30036 
.text           C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 00B30FA5 
.text           C:\WINDOWS\system32\svchost.exe[1356] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\svchost.exe[1356] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 00B20FA4 
.text           C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 00B20FB5 
.text           C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 00B20FD7 
.text           C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 00B20000 
.text           C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 00B20FC6 
.text           C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 00B20011 
.text           C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 00B10000 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtClose                   7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtClose + 4               7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtCreateFile              7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtCreateFile              7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtCreateFile + 4          7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtCreateKey               7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtCreateKey + 4           7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtCreateSection           7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtCreateSection + 4       7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtDeleteKey               7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtDeleteKey + 4           7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtDeleteValueKey          7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtDeleteValueKey + 4      7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtRenameKey               7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtRenameKey + 4           7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtSetInformationFile      7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtSetInformationFile + 4  7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtSetValueKey             7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtSetValueKey + 4         7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtTerminateProcess        7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtTerminateProcess + 4    7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtWriteFile               7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtWriteFile + 4           7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtWriteFileGather         7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtWriteFileGather + 4     7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtWriteVirtualMemory      7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] ntdll.dll!NtWriteVirtualMemory + 4  7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] KERNEL32.dll!LoadLibraryExW + C4    7C801BB9 4 Bytes  CALL 01090001 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] USER32.dll!SetWindowsHookExW        7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe[1456] USER32.dll!SetWindowsHookExA        7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[1596] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 00A10001 
.text           C:\WINDOWS\system32\spoolsv.exe[1596] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[1596] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtClose                                       7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtClose + 4                                   7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtCreateFile                                  7C90D0AE 1 Byte  [FF]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtCreateFile                                  7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtCreateFile + 4                              7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtCreateKey                                   7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtCreateKey + 4                               7C90D0F2 2 Bytes  [05, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtCreateSection                               7C90D17E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtCreateSection + 4                           7C90D182 2 Bytes  [23, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtDeleteKey                                   7C90D24E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtDeleteKey + 4                               7C90D252 2 Bytes  [0B, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtDeleteValueKey                              7C90D26E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtDeleteValueKey + 4                          7C90D272 2 Bytes  [11, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtRenameKey                                   7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtRenameKey + 4                               7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtSetInformationFile                          7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtSetInformationFile + 4                      7C90DC62 2 Bytes  [20, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtSetValueKey                                 7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtSetValueKey + 4                             7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtTerminateProcess                            7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtTerminateProcess + 4                        7C90DE72 2 Bytes  [26, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtWriteFile                                   7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtWriteFile + 4                               7C90DF82 2 Bytes  [1A, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtWriteFileGather                             7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtWriteFileGather + 4                         7C90DF92 2 Bytes  [1D, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtWriteVirtualMemory                          7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] ntdll.dll!NtWriteVirtualMemory + 4                      7C90DFB2 2 Bytes  [29, 5F]
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] kernel32.dll!LoadLibraryExW + C4                        7C801BB9 4 Bytes  CALL 00FC0001 
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] USER32.dll!SetWindowsHookExW                            7E42820F 6 Bytes  JMP 5F320F5A 
.text           c:\program files\idt\xpm09_6162v012\wdm\STacSV.exe[1636] USER32.dll!SetWindowsHookExA                            7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtClose                                                         7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtClose + 4                                                     7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtCreateFile                                                    7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtCreateFile                                                    7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtCreateFile + 4                                                7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtCreateKey                                                     7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtCreateKey + 4                                                 7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtCreateSection                                                 7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtCreateSection + 4                                             7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtDeleteKey                                                     7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtDeleteKey + 4                                                 7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtDeleteValueKey                                                7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtDeleteValueKey + 4                                            7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtRenameKey                                                     7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtRenameKey + 4                                                 7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtSetInformationFile                                            7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtSetInformationFile + 4                                        7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtSetValueKey                                                   7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtSetValueKey + 4                                               7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtTerminateProcess                                              7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtTerminateProcess + 4                                          7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtWriteFile                                                     7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtWriteFile + 4                                                 7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtWriteFileGather                                               7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtWriteFileGather + 4                                           7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtWriteVirtualMemory                                            7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] ntdll.dll!NtWriteVirtualMemory + 4                                        7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] kernel32.dll!LoadLibraryExW + C4                                          7C801BB9 4 Bytes  CALL 010C0001 
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] USER32.dll!ChangeDisplaySettingsExA                                       7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] USER32.dll!SetForegroundWindow                                            7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] USER32.dll!SetWindowsHookExW                                              7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] USER32.dll!SetWindowPos                                                   7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] USER32.dll!SetWindowPos + 4                                               7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] USER32.dll!SetWindowsHookExA                                              7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\igfxsrvc.exe[1684] USER32.dll!ChangeDisplaySettingsExW                                       7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtClose                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtClose + 4                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtCreateFile                     7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtCreateFile                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtCreateFile + 4                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtCreateKey                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtCreateKey + 4                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtCreateSection                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtCreateSection + 4              7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtDeleteKey                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtDeleteKey + 4                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtDeleteValueKey                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtDeleteValueKey + 4             7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtRenameKey                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtRenameKey + 4                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtSetInformationFile             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtSetInformationFile + 4         7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtSetValueKey                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtSetValueKey + 4                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtTerminateProcess               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtTerminateProcess + 4           7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtWriteFile                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtWriteFile + 4                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtWriteFileGather                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtWriteFileGather + 4            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtWriteVirtualMemory             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] ntdll.dll!NtWriteVirtualMemory + 4         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] kernel32.dll!LoadLibraryExW + C4           7C801BB9 4 Bytes  CALL 011B0001 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] USER32.dll!ChangeDisplaySettingsExA        7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] USER32.dll!SetForegroundWindow             7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] USER32.dll!SetWindowsHookExW               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] USER32.dll!SetWindowPos                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] USER32.dll!SetWindowPos + 4                7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] USER32.dll!SetWindowsHookExA               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1724] USER32.dll!ChangeDisplaySettingsExW        7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtClose                                     7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtClose + 4                                 7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtCreateFile                                7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtCreateFile                                7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtCreateFile + 4                            7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtCreateKey                                 7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtCreateKey + 4                             7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtCreateSection                             7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtCreateSection + 4                         7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtDeleteKey                                 7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtDeleteKey + 4                             7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtDeleteValueKey                            7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtDeleteValueKey + 4                        7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtRenameKey                                 7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtRenameKey + 4                             7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtSetInformationFile                        7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtSetInformationFile + 4                    7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtSetValueKey                               7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtSetValueKey + 4                           7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtTerminateProcess                          7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtTerminateProcess + 4                      7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtWriteFile                                 7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtWriteFile + 4                             7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtWriteFileGather                           7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtWriteFileGather + 4                       7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtWriteVirtualMemory                        7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] ntdll.dll!NtWriteVirtualMemory + 4                    7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] kernel32.dll!LoadLibraryExW + C4                      7C801BB9 4 Bytes  CALL 04B90001 
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] USER32.dll!ChangeDisplaySettingsExA                   7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] USER32.dll!SetForegroundWindow                        7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] USER32.dll!SetWindowsHookExW                          7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] USER32.dll!SetWindowPos                               7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] USER32.dll!SetWindowPos + 4                           7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] USER32.dll!SetWindowsHookExA                          7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1776] USER32.dll!ChangeDisplaySettingsExW                   7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1828] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 00CE0FE5 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 00CE0F69 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00CE0F7A 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 00CE0054 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 00CE0FA1 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 00CE0039 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 00CE0F2C 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 00CE0F47 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 00CE0F00 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 00CE0F1B 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 00CE00B4 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 00CE0FB2 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 00CE0FD4 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 00CE0F58 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 00CE0FC3 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 00CE0014 
.text           C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 00CE0099 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 00A30FAF 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 00A30F79 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 00A3000A 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 00A30FD4 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 00A30036 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 00A30FEF 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 5 Bytes  JMP 00A30025 
.text           C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 00A30F9E 
.text           C:\WINDOWS\system32\svchost.exe[1828] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\svchost.exe[1828] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 00A20FC3 
.text           C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 00A2004E 
.text           C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 00A20FEF 
.text           C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 00A2000C 
.text           C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 00A20FDE 
.text           C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 00A2001D 
.text           C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenA                                                  3D95D690 5 Bytes  JMP 00A00FE5 
.text           C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenW                                                  3D95DB09 5 Bytes  JMP 00A00FD4 
.text           C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenUrlA                                               3D95F3A4 5 Bytes  JMP 00A00FC3 
.text           C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenUrlW                                               3D9A6DDF 5 Bytes  JMP 00A00FB2 
.text           C:\WINDOWS\system32\svchost.exe[1828] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 00A1000A 
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 009D0001 
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] kernel32.dll!FreeLibrary + 15                                              7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] USER32.dll!ChangeDisplaySettingsExA                                        7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] USER32.dll!SetForegroundWindow                                             7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] USER32.dll!SetWindowPos                                                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] USER32.dll!SetWindowPos + 4                                                7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\WISPTIS.EXE[1856] USER32.dll!ChangeDisplaySettingsExW                                        7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtClose                                                   7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtClose + 4                                               7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtCreateFile                                              7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtCreateFile                                              7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtCreateFile + 4                                          7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtCreateKey                                               7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtCreateKey + 4                                           7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtCreateSection                                           7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtCreateSection + 4                                       7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtDeleteKey                                               7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtDeleteKey + 4                                           7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtDeleteValueKey                                          7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtDeleteValueKey + 4                                      7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtRenameKey                                               7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtRenameKey + 4                                           7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtSetInformationFile                                      7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtSetInformationFile + 4                                  7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtSetValueKey                                             7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtSetValueKey + 4                                         7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtTerminateProcess                                        7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtTerminateProcess + 4                                    7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtWriteFile                                               7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtWriteFile + 4                                           7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtWriteFileGather                                         7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtWriteFileGather + 4                                     7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtWriteVirtualMemory                                      7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] ntdll.dll!NtWriteVirtualMemory + 4                                  7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] kernel32.dll!LoadLibraryExW + C4                                    7C801BB9 4 Bytes  CALL 01490001 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] USER32.dll!SetWindowsHookExW                                        7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1900] USER32.dll!SetWindowsHookExA                                        7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtClose                                                      7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtClose + 4                                                  7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtCreateFile                                                 7C90D0AE 1 Byte  [FF]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtCreateFile                                                 7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtCreateFile + 4                                             7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtCreateKey                                                  7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtCreateKey + 4                                              7C90D0F2 2 Bytes  [05, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtCreateSection                                              7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtCreateSection + 4                                          7C90D182 2 Bytes  [23, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtDeleteKey                                                  7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtDeleteKey + 4                                              7C90D252 2 Bytes  [0B, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtDeleteValueKey                                             7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtDeleteValueKey + 4                                         7C90D272 2 Bytes  [11, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtRenameKey                                                  7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtRenameKey + 4                                              7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtSetInformationFile                                         7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtSetInformationFile + 4                                     7C90DC62 2 Bytes  [20, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtSetValueKey                                                7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtSetValueKey + 4                                            7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtTerminateProcess                                           7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtTerminateProcess + 4                                       7C90DE72 2 Bytes  [26, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtWriteFile                                                  7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtWriteFile + 4                                              7C90DF82 2 Bytes  [1A, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtWriteFileGather                                            7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtWriteFileGather + 4                                        7C90DF92 2 Bytes  [1D, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtWriteVirtualMemory                                         7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] ntdll.dll!NtWriteVirtualMemory + 4                                     7C90DFB2 2 Bytes  [29, 5F]
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] kernel32.dll!LoadLibraryExW + C4                                       7C801BB9 4 Bytes  CALL 02380001 
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] USER32.dll!SetWindowsHookExW                                           7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1972] USER32.dll!SetWindowsHookExA                                           7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtClose                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtClose + 4                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtCreateFile                     7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtCreateFile                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtCreateFile + 4                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtCreateKey                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtCreateKey + 4                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtCreateSection                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtCreateSection + 4              7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtDeleteKey                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtDeleteKey + 4                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtDeleteValueKey                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtDeleteValueKey + 4             7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtRenameKey                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtRenameKey + 4                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtSetInformationFile             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtSetInformationFile + 4         7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtSetValueKey                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtSetValueKey + 4                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtTerminateProcess               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtTerminateProcess + 4           7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtWriteFile                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtWriteFile + 4                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtWriteFileGather                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtWriteFileGather + 4            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtWriteVirtualMemory             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] ntdll.dll!NtWriteVirtualMemory + 4         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] kernel32.dll!LoadLibraryExW + C4           7C801BB9 4 Bytes  CALL 00A00001 
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] USER32.dll!SetWindowsHookExW               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2036] USER32.dll!SetWindowsHookExA               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtClose                                            7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtClose + 4                                        7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtCreateFile                                       7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtCreateFile                                       7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtCreateFile + 4                                   7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtCreateKey                                        7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtCreateKey + 4                                    7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtCreateSection                                    7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtCreateSection + 4                                7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtDeleteKey                                        7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtDeleteKey + 4                                    7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtDeleteValueKey                                   7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtDeleteValueKey + 4                               7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtRenameKey                                        7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtRenameKey + 4                                    7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtSetInformationFile                               7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtSetInformationFile + 4                           7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtSetValueKey                                      7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtSetValueKey + 4                                  7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtTerminateProcess                                 7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtTerminateProcess + 4                             7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtWriteFile                                        7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtWriteFile + 4                                    7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtWriteFileGather                                  7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtWriteFileGather + 4                              7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtWriteVirtualMemory                               7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] ntdll.dll!NtWriteVirtualMemory + 4                           7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] kernel32.dll!LoadLibraryExW + C4                             7C801BB9 4 Bytes  CALL 01470001 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] USER32.dll!ChangeDisplaySettingsExA                          7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] USER32.dll!SetForegroundWindow                               7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] USER32.dll!SetWindowsHookExW                                 7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] USER32.dll!SetWindowPos                                      7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] USER32.dll!SetWindowPos + 4                                  7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] USER32.dll!SetWindowsHookExA                                 7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2044] USER32.dll!ChangeDisplaySettingsExW                          7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtClose                                     7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtClose + 4                                 7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtCreateFile                                7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtCreateFile                                7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtCreateFile + 4                            7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtCreateKey                                 7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtCreateKey + 4                             7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtCreateSection                             7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtCreateSection + 4                         7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtDeleteKey                                 7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtDeleteKey + 4                             7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtDeleteValueKey                            7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtDeleteValueKey + 4                        7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtRenameKey                                 7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtRenameKey + 4                             7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtSetInformationFile                        7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtSetInformationFile + 4                    7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtSetValueKey                               7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtSetValueKey + 4                           7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtTerminateProcess                          7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtTerminateProcess + 4                      7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtWriteFile                                 7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtWriteFile + 4                             7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtWriteFileGather                           7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtWriteFileGather + 4                       7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtWriteVirtualMemory                        7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] ntdll.dll!NtWriteVirtualMemory + 4                    7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] kernel32.dll!LoadLibraryExW + C4                      7C801BB9 4 Bytes  CALL 01C50001 
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] USER32.dll!SetWindowsHookExW                          7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2072] USER32.dll!SetWindowsHookExA                          7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtClose                                                      7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtClose + 4                                                  7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtCreateFile                                                 7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtCreateFile                                                 7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtCreateFile + 4                                             7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtCreateKey                                                  7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtCreateKey + 4                                              7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtCreateSection                                              7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtCreateSection + 4                                          7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtDeleteKey                                                  7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtDeleteKey + 4                                              7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtDeleteValueKey                                             7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtDeleteValueKey + 4                                         7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtRenameKey                                                  7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtRenameKey + 4                                              7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtSetInformationFile                                         7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtSetInformationFile + 4                                     7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtSetValueKey                                                7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtSetValueKey + 4                                            7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtTerminateProcess                                           7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtTerminateProcess + 4                                       7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtWriteFile                                                  7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtWriteFile + 4                                              7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtWriteFileGather                                            7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtWriteFileGather + 4                                        7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtWriteVirtualMemory                                         7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] ntdll.dll!NtWriteVirtualMemory + 4                                     7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] kernel32.dll!LoadLibraryExW + C4                                       7C801BB9 4 Bytes  CALL 00FA0001 
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] USER32.dll!ChangeDisplaySettingsExA                                    7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] USER32.dll!SetForegroundWindow                                         7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] USER32.dll!SetWindowsHookExW                                           7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] USER32.dll!SetWindowPos                                                7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] USER32.dll!SetWindowPos + 4                                            7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] USER32.dll!SetWindowsHookExA                                           7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\IDT\WDM\sttray.exe[2104] USER32.dll!ChangeDisplaySettingsExW                                    7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[2156] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 00CD0FE5 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 00CD005B 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00CD0F66 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 00CD0F8D 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 00CD004A 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 00CD0F9E 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 00CD0087 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 00CD0F4B 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 00CD0EF5 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 00CD0098 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 00CD00A9 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 00CD002F 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 00CD0FD4 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 00CD006C 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 00CD0014 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 00CD0FC3 
.text           C:\WINDOWS\system32\svchost.exe[2156] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 00CD0F1A 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 00CC0F9E 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 00CC0025 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 00CC0FB9 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 00CC0FD4 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 00CC0F68 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 00CC0FE5 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 2 Bytes  JMP 00CC0F79 
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyW + 3                                             77DFBA58 2 Bytes  [EC, 88]
.text           C:\WINDOWS\system32\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 00CC000A 
.text           C:\WINDOWS\system32\svchost.exe[2156] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\svchost.exe[2156] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[2156] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 00CB0FB7 
.text           C:\WINDOWS\system32\svchost.exe[2156] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 00CB0038 
.text           C:\WINDOWS\system32\svchost.exe[2156] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 00CB0FD2 
.text           C:\WINDOWS\system32\svchost.exe[2156] msvcrt.dll!_open                                                           77C2F566 3 Bytes  JMP 00CB0FEF 
.text           C:\WINDOWS\system32\svchost.exe[2156] msvcrt.dll!_open + 4                                                       77C2F56A 1 Byte  [89]
.text           C:\WINDOWS\system32\svchost.exe[2156] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 00CB0027 
.text           C:\WINDOWS\system32\svchost.exe[2156] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 00CB000C 
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtClose                                           7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtClose + 4                                       7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtCreateFile                                      7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtCreateFile                                      7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtCreateFile + 4                                  7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtCreateKey                                       7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtCreateKey + 4                                   7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtCreateSection                                   7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtCreateSection + 4                               7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtDeleteKey                                       7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtDeleteKey + 4                                   7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtDeleteValueKey                                  7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtDeleteValueKey + 4                              7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtRenameKey                                       7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtRenameKey + 4                                   7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtSetInformationFile                              7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtSetInformationFile + 4                          7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtSetValueKey                                     7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtSetValueKey + 4                                 7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtTerminateProcess                                7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtTerminateProcess + 4                            7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtWriteFile                                       7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtWriteFile + 4                                   7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtWriteFileGather                                 7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtWriteFileGather + 4                             7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtWriteVirtualMemory                              7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] ntdll.dll!NtWriteVirtualMemory + 4                          7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] KERNEL32.dll!LoadLibraryExW + C4                            7C801BB9 4 Bytes  CALL 04310001 
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] USER32.dll!ChangeDisplaySettingsExA                         7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] USER32.dll!SetForegroundWindow                              7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] USER32.dll!SetWindowsHookExW                                7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] USER32.dll!SetWindowPos                                     7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] USER32.dll!SetWindowPos + 4                                 7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] USER32.dll!SetWindowsHookExA                                7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe[2208] USER32.dll!ChangeDisplaySettingsExW                         7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtClose                                                           7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtClose + 4                                                       7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtCreateFile                                                      7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtCreateFile                                                      7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtCreateFile + 4                                                  7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtCreateKey                                                       7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtCreateKey + 4                                                   7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtCreateSection                                                   7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtCreateSection + 4                                               7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtDeleteKey                                                       7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtDeleteKey + 4                                                   7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtDeleteValueKey                                                  7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtDeleteValueKey + 4                                              7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtRenameKey                                                       7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtRenameKey + 4                                                   7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtSetInformationFile                                              7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtSetInformationFile + 4                                          7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtSetValueKey                                                     7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtSetValueKey + 4                                                 7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtTerminateProcess                                                7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtTerminateProcess + 4                                            7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtWriteFile                                                       7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtWriteFile + 4                                                   7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtWriteFileGather                                                 7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtWriteFileGather + 4                                             7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtWriteVirtualMemory                                              7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] ntdll.dll!NtWriteVirtualMemory + 4                                          7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] kernel32.dll!LoadLibraryExW + C4                                            7C801BB9 4 Bytes  CALL 00630001 
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] USER32.dll!SetWindowsHookExW                                                7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\wdfmgr.exe[2248] USER32.dll!SetWindowsHookExA                                                7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[2256] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 001A0FEF 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 001A0FA5 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 001A0090 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 001A007F 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 001A0062 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 001A0051 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 001A0F94 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 001A00D0 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 001A0108 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 001A00F7 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!FreeLibrary + 15                                              7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 001A0123 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 001A0FCA 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 001A000A 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 001A00B5 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 001A0036 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 001A001B 
.text           C:\WINDOWS\System32\svchost.exe[2256] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 001A0F6F 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 00290011 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 00290047 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 00290000 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 00290FD4 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 00290036 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 00290FEF 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 2 Bytes  JMP 00290F94 
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegCreateKeyW + 3                                             77DFBA58 2 Bytes  [49, 88]
.text           C:\WINDOWS\System32\svchost.exe[2256] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 00290FAF 
.text           C:\WINDOWS\System32\svchost.exe[2256] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\System32\svchost.exe[2256] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\System32\svchost.exe[2256] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 003E0053 
.text           C:\WINDOWS\System32\svchost.exe[2256] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 003E0042 
.text           C:\WINDOWS\System32\svchost.exe[2256] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 003E000C 
.text           C:\WINDOWS\System32\svchost.exe[2256] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 003E0FE3 
.text           C:\WINDOWS\System32\svchost.exe[2256] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 003E0031 
.text           C:\WINDOWS\System32\svchost.exe[2256] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 003E0FD2 
.text           C:\WINDOWS\System32\svchost.exe[2256] WS2_32.dll!socket                                                          71AB4211 5 Bytes  JMP 00760FE5 
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtClose                                     7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtClose + 4                                 7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtCreateFile                                7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtCreateFile                                7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtCreateFile + 4                            7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtCreateKey                                 7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtCreateKey + 4                             7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtCreateSection                             7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtCreateSection + 4                         7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtDeleteKey                                 7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtDeleteKey + 4                             7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtDeleteValueKey                            7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtDeleteValueKey + 4                        7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtRenameKey                                 7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtRenameKey + 4                             7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtSetInformationFile                        7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtSetInformationFile + 4                    7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtSetValueKey                               7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtSetValueKey + 4                           7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtTerminateProcess                          7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtTerminateProcess + 4                      7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtWriteFile                                 7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtWriteFile + 4                             7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtWriteFileGather                           7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtWriteFileGather + 4                       7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtWriteVirtualMemory                        7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] ntdll.dll!NtWriteVirtualMemory + 4                    7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] kernel32.dll!LoadLibraryExW + C4                      7C801BB9 4 Bytes  CALL 00D20001 
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] USER32.dll!ChangeDisplaySettingsExA                   7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] USER32.dll!SetForegroundWindow                        7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] USER32.dll!SetWindowsHookExW                          7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] USER32.dll!SetWindowPos                               7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] USER32.dll!SetWindowPos + 4                           7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] USER32.dll!SetWindowsHookExA                          7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2324] USER32.dll!ChangeDisplaySettingsExW                   7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtClose                                                    7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtClose + 4                                                7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtCreateFile                                               7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtCreateFile                                               7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtCreateFile + 4                                           7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtCreateKey                                                7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtCreateKey + 4                                            7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtCreateSection                                            7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtCreateSection + 4                                        7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtDeleteKey                                                7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtDeleteKey + 4                                            7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtDeleteValueKey                                           7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtDeleteValueKey + 4                                       7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtRenameKey                                                7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtRenameKey + 4                                            7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtSetInformationFile                                       7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtSetInformationFile + 4                                   7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtSetValueKey                                              7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtSetValueKey + 4                                          7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtTerminateProcess                                         7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtTerminateProcess + 4                                     7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtWriteFile                                                7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtWriteFile + 4                                            7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtWriteFileGather                                          7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtWriteFileGather + 4                                      7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtWriteVirtualMemory                                       7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] ntdll.dll!NtWriteVirtualMemory + 4                                   7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] kernel32.dll!LoadLibraryExW + C4                                     7C801BB9 4 Bytes  CALL 0DAE0001 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] kernel32.dll!WriteFile                                               7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] USER32.dll!SetWindowsHookExW                                         7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2420] USER32.dll!SetWindowsHookExA                                         7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtClose                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtClose + 4                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtCreateFile                     7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtCreateFile                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtCreateFile + 4                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtCreateKey                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtCreateKey + 4                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtCreateSection                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtCreateSection + 4              7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtDeleteKey                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtDeleteKey + 4                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtDeleteValueKey                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtDeleteValueKey + 4             7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtRenameKey                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtRenameKey + 4                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtSetInformationFile             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtSetInformationFile + 4         7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtSetValueKey                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtSetValueKey + 4                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtTerminateProcess               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtTerminateProcess + 4           7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtWriteFile                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtWriteFile + 4                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtWriteFileGather                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtWriteFileGather + 4            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtWriteVirtualMemory             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] ntdll.dll!NtWriteVirtualMemory + 4         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] kernel32.dll!LoadLibraryExW + C4           7C801BB9 4 Bytes  CALL 017D0001 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] USER32.dll!ChangeDisplaySettingsExA        7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] USER32.dll!SetForegroundWindow             7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] USER32.dll!SetWindowsHookExW               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] USER32.dll!SetWindowPos                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] USER32.dll!SetWindowPos + 4                7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] USER32.dll!SetWindowsHookExA               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2428] USER32.dll!ChangeDisplaySettingsExW        7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtClose                                                           7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtClose + 4                                                       7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtCreateFile                                                      7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtCreateFile                                                      7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtCreateFile + 4                                                  7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtCreateKey                                                       7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtCreateKey + 4                                                   7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtCreateSection                                                   7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtCreateSection + 4                                               7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtDeleteKey                                                       7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtDeleteKey + 4                                                   7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtDeleteValueKey                                                  7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtDeleteValueKey + 4                                              7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtRenameKey                                                       7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtRenameKey + 4                                                   7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtSetInformationFile                                              7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtSetInformationFile + 4                                          7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtSetValueKey                                                     7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtSetValueKey + 4                                                 7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtTerminateProcess                                                7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtTerminateProcess + 4                                            7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtWriteFile                                                       7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtWriteFile + 4                                                   7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtWriteFileGather                                                 7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtWriteFileGather + 4                                             7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtWriteVirtualMemory                                              7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] ntdll.dll!NtWriteVirtualMemory + 4                                          7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] kernel32.dll!LoadLibraryExW + C4                                            7C801BB9 4 Bytes  CALL 00D10001 
.text           C:\WINDOWS\system32\ctfmon.exe[2696] USER32.dll!ChangeDisplaySettingsExA                                         7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2696] USER32.dll!SetForegroundWindow                                              7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2696] USER32.dll!SetWindowsHookExW                                                7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2696] USER32.dll!SetWindowPos                                                     7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] USER32.dll!SetWindowPos + 4                                                 7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2696] USER32.dll!SetWindowsHookExA                                                7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2696] USER32.dll!ChangeDisplaySettingsExW                                         7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtClose                                                 7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtClose + 4                                             7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtCreateFile                                            7C90D0AE 1 Byte  [FF]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtCreateFile                                            7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtCreateFile + 4                                        7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtCreateKey                                             7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtCreateKey + 4                                         7C90D0F2 2 Bytes  [05, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtCreateSection                                         7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtCreateSection + 4                                     7C90D182 2 Bytes  [23, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtDeleteKey                                             7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtDeleteKey + 4                                         7C90D252 2 Bytes  [0B, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtDeleteValueKey                                        7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtDeleteValueKey + 4                                    7C90D272 2 Bytes  [11, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtRenameKey                                             7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtRenameKey + 4                                         7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtSetInformationFile                                    7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtSetInformationFile + 4                                7C90DC62 2 Bytes  [20, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtSetValueKey                                           7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtSetValueKey + 4                                       7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtTerminateProcess                                      7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtTerminateProcess + 4                                  7C90DE72 2 Bytes  [26, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtWriteFile                                             7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtWriteFile + 4                                         7C90DF82 2 Bytes  [1A, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtWriteFileGather                                       7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtWriteFileGather + 4                                   7C90DF92 2 Bytes  [1D, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtWriteVirtualMemory                                    7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] ntdll.dll!NtWriteVirtualMemory + 4                                7C90DFB2 2 Bytes  [29, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] kernel32.dll!LoadLibraryExW + C4                                  7C801BB9 4 Bytes  CALL 00890001 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] kernel32.dll!FreeLibrary + 15                                     7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] USER32.dll!SetWindowsHookExW                                      7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[2780] USER32.dll!SetWindowsHookExA                                      7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtClose                                       7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtClose + 4                                   7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtCreateFile                                  7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtCreateFile                                  7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtCreateFile + 4                              7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtCreateKey                                   7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtCreateKey + 4                               7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtCreateSection                               7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtCreateSection + 4                           7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtDeleteKey                                   7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtDeleteKey + 4                               7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtDeleteValueKey                              7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtDeleteValueKey + 4                          7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtRenameKey                                   7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtRenameKey + 4                               7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtSetInformationFile                          7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtSetInformationFile + 4                      7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtSetValueKey                                 7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtSetValueKey + 4                             7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtTerminateProcess                            7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtTerminateProcess + 4                        7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtWriteFile                                   7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtWriteFile + 4                               7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtWriteFileGather                             7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtWriteFileGather + 4                         7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtWriteVirtualMemory                          7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] ntdll.dll!NtWriteVirtualMemory + 4                      7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] kernel32.dll!LoadLibraryExW + C4                        7C801BB9 4 Bytes  CALL 01040001 
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] USER32.dll!ChangeDisplaySettingsExA                     7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] USER32.dll!SetForegroundWindow                          7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] USER32.dll!SetWindowsHookExW                            7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] USER32.dll!SetWindowPos                                 7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] USER32.dll!SetWindowPos + 4                             7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] USER32.dll!SetWindowsHookExA                            7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2860] USER32.dll!ChangeDisplaySettingsExW                     7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtClose                                 7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtClose + 4                             7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtCreateFile                            7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtCreateFile                            7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtCreateFile + 4                        7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtCreateKey                             7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtCreateKey + 4                         7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtCreateSection                         7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtCreateSection + 4                     7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtDeleteKey                             7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtDeleteKey + 4                         7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtDeleteValueKey                        7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtDeleteValueKey + 4                    7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtRenameKey                             7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtRenameKey + 4                         7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtSetInformationFile                    7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtSetInformationFile + 4                7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtSetValueKey                           7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtSetValueKey + 4                       7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtTerminateProcess                      7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtTerminateProcess + 4                  7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtWriteFile                             7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtWriteFile + 4                         7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtWriteFileGather                       7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtWriteFileGather + 4                   7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtWriteVirtualMemory                    7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] ntdll.dll!NtWriteVirtualMemory + 4                7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] kernel32.dll!LoadLibraryExW + C4                  7C801BB9 4 Bytes  CALL 00DA0001 
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] USER32.dll!ChangeDisplaySettingsExA               7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] USER32.dll!SetForegroundWindow                    7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] USER32.dll!SetWindowsHookExW                      7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] USER32.dll!SetWindowPos                           7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] USER32.dll!SetWindowPos + 4                       7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] USER32.dll!SetWindowsHookExA                      7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[3092] USER32.dll!ChangeDisplaySettingsExW               7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[3172] kernel32.dll!LoadLibraryExW + C4                              7C801BB9 4 Bytes  CALL 03C30001 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[3172] kernel32.dll!CreateThread + 1B                                7C8106F2 3 Bytes  CALL 0044ACCE C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[3172] USER32.dll!SetWindowsHookExW                                  7E42820F 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[3172] USER32.dll!SetWindowsHookExA                                  7E431211 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtClose                    7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtClose + 4                7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtCreateFile               7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtCreateFile               7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtCreateFile + 4           7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtCreateKey                7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtCreateKey + 4            7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtCreateSection            7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtCreateSection + 4        7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtDeleteKey                7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtDeleteKey + 4            7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtDeleteValueKey           7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtDeleteValueKey + 4       7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtRenameKey                7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtRenameKey + 4            7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtSetInformationFile       7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtSetInformationFile + 4   7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtSetValueKey              7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtSetValueKey + 4          7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtTerminateProcess         7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtTerminateProcess + 4     7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtWriteFile                7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtWriteFile + 4            7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtWriteFileGather          7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtWriteFileGather + 4      7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtWriteVirtualMemory       7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] ntdll.dll!NtWriteVirtualMemory + 4   7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] kernel32.dll!LoadLibraryExW + C4     7C801BB9 4 Bytes  CALL 026A0001 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] USER32.dll!ChangeDisplaySettingsExA  7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] USER32.dll!SetForegroundWindow       7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] USER32.dll!SetWindowsHookExW         7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] USER32.dll!SetWindowPos              7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] USER32.dll!SetWindowPos + 4          7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] USER32.dll!SetWindowsHookExA         7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3184] USER32.dll!ChangeDisplaySettingsExW  7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtClose                                7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtClose + 4                            7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtCreateFile                           7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtCreateFile                           7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtCreateFile + 4                       7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtCreateKey                            7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtCreateKey + 4                        7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtCreateSection                        7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtCreateSection + 4                    7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtDeleteKey                            7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtDeleteKey + 4                        7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtDeleteValueKey                       7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtDeleteValueKey + 4                   7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtRenameKey                            7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtRenameKey + 4                        7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtSetInformationFile                   7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtSetInformationFile + 4               7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtSetValueKey                          7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtSetValueKey + 4                      7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtTerminateProcess                     7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtTerminateProcess + 4                 7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtWriteFile                            7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtWriteFile + 4                        7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtWriteFileGather                      7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtWriteFileGather + 4                  7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtWriteVirtualMemory                   7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] ntdll.dll!NtWriteVirtualMemory + 4               7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] kernel32.dll!LoadLibraryExW + C4                 7C801BB9 4 Bytes  CALL 02420001 
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] USER32.dll!ChangeDisplaySettingsExA              7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] USER32.dll!SetForegroundWindow                   7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] USER32.dll!SetWindowsHookExW                     7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] USER32.dll!SetWindowPos                          7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] USER32.dll!SetWindowPos + 4                      7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] USER32.dll!SetWindowsHookExA                     7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Windows Desktop Search\WindowsSearch.exe[3256] USER32.dll!ChangeDisplaySettingsExW              7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtClose                                                         7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtClose + 4                                                     7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtCreateFile                                                    7C90D0AE 1 Byte  [FF]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtCreateFile                                                    7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtCreateFile + 4                                                7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtCreateKey                                                     7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtCreateKey + 4                                                 7C90D0F2 2 Bytes  [05, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtCreateSection                                                 7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtCreateSection + 4                                             7C90D182 2 Bytes  [23, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtDeleteKey                                                     7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtDeleteKey + 4                                                 7C90D252 2 Bytes  [0B, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtDeleteValueKey                                                7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtDeleteValueKey + 4                                            7C90D272 2 Bytes  [11, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtRenameKey                                                     7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtRenameKey + 4                                                 7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtSetInformationFile                                            7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtSetInformationFile + 4                                        7C90DC62 2 Bytes  [20, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtSetValueKey                                                   7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtSetValueKey + 4                                               7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtTerminateProcess                                              7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtTerminateProcess + 4                                          7C90DE72 2 Bytes  [26, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtWriteFile                                                     7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtWriteFile + 4                                                 7C90DF82 2 Bytes  [1A, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtWriteFileGather                                               7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtWriteFileGather + 4                                           7C90DF92 2 Bytes  [1D, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtWriteVirtualMemory                                            7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] ntdll.dll!NtWriteVirtualMemory + 4                                        7C90DFB2 2 Bytes  [29, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] kernel32.dll!LoadLibraryExW + C4                                          7C801BB9 4 Bytes  CALL 00FF0001 
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] USER32.dll!ChangeDisplaySettingsExA                                       7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] USER32.dll!SetForegroundWindow                                            7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] USER32.dll!SetWindowsHookExW                                              7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] USER32.dll!SetWindowPos                                                   7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] USER32.dll!SetWindowPos + 4                                               7E4299F7 2 Bytes  [3A, 5F]
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] USER32.dll!SetWindowsHookExA                                              7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\PROGRA~1\MI3AA1~1\rapimgr.exe[3260] USER32.dll!ChangeDisplaySettingsExW                                       7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtClose                                                    7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtClose + 4                                                7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtCreateFile                                               7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtCreateFile                                               7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtCreateFile + 4                                           7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtCreateKey                                                7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtCreateKey + 4                                            7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtCreateSection                                            7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtCreateSection + 4                                        7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtDeleteKey                                                7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtDeleteKey + 4                                            7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtDeleteValueKey                                           7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtDeleteValueKey + 4                                       7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtRenameKey                                                7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtRenameKey + 4                                            7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtSetInformationFile                                       7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtSetInformationFile + 4                                   7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtSetValueKey                                              7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtSetValueKey + 4                                          7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtTerminateProcess                                         7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtTerminateProcess + 4                                     7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtWriteFile                                                7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtWriteFile + 4                                            7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtWriteFileGather                                          7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtWriteFileGather + 4                                      7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtWriteVirtualMemory                                       7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] ntdll.dll!NtWriteVirtualMemory + 4                                   7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] kernel32.dll!LoadLibraryExW + C4                                     7C801BB9 4 Bytes  CALL 00C20001 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] USER32.dll!SetWindowsHookExW                                         7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3268] USER32.dll!SetWindowsHookExA                                         7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtClose                                                              7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtClose + 4                                                          7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtCreateFile                                                         7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtCreateFile                                                         7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtCreateFile + 4                                                     7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtCreateKey                                                          7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtCreateKey + 4                                                      7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtCreateSection                                                      7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtCreateSection + 4                                                  7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtDeleteKey                                                          7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtDeleteKey + 4                                                      7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtDeleteValueKey                                                     7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtDeleteValueKey + 4                                                 7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtRenameKey                                                          7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtRenameKey + 4                                                      7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtSetInformationFile                                                 7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtSetInformationFile + 4                                             7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtSetValueKey                                                        7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtSetValueKey + 4                                                    7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtTerminateProcess                                                   7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtTerminateProcess + 4                                               7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtWriteFile                                                          7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtWriteFile + 4                                                      7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtWriteFileGather                                                    7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtWriteFileGather + 4                                                7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtWriteVirtualMemory                                                 7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\alg.exe[3280] ntdll.dll!NtWriteVirtualMemory + 4                                             7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\System32\alg.exe[3280] kernel32.dll!LoadLibraryExW + C4                                               7C801BB9 4 Bytes  CALL 00A20001 
.text           C:\WINDOWS\System32\alg.exe[3280] USER32.dll!SetWindowsHookExW                                                   7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\System32\alg.exe[3280] USER32.dll!SetWindowsHookExA                                                   7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtClose                                     7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtClose + 4                                 7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtCreateFile                                7C90D0AE 1 Byte  [FF]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtCreateFile                                7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtCreateFile + 4                            7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtCreateKey                                 7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtCreateKey + 4                             7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtCreateSection                             7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtCreateSection + 4                         7C90D182 2 Bytes  [23, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtDeleteKey                                 7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtDeleteKey + 4                             7C90D252 2 Bytes  [0B, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtDeleteValueKey                            7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtDeleteValueKey + 4                        7C90D272 2 Bytes  [11, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtRenameKey                                 7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtRenameKey + 4                             7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtSetInformationFile                        7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtSetInformationFile + 4                    7C90DC62 2 Bytes  [20, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtSetValueKey                               7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtSetValueKey + 4                           7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtTerminateProcess                          7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtTerminateProcess + 4                      7C90DE72 2 Bytes  [26, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtWriteFile                                 7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtWriteFile + 4                             7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtWriteFileGather                           7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtWriteFileGather + 4                       7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtWriteVirtualMemory                        7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] ntdll.dll!NtWriteVirtualMemory + 4                    7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] kernel32.dll!LoadLibraryExW + C4                      7C801BB9 4 Bytes  CALL 003D0001 
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] kernel32.dll!FreeLibrary + 15                         7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] USER32.dll!ChangeDisplaySettingsExA                   7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] USER32.dll!SetForegroundWindow                        7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] USER32.dll!SetWindowsHookExW                          7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] USER32.dll!SetWindowPos                               7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] USER32.dll!SetWindowPos + 4                           7E4299F7 2 Bytes  [3A, 5F]
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] USER32.dll!SetWindowsHookExA                          7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\Documents and Settings\Burt\Desktop\gmer\gmer.exe[4012] USER32.dll!ChangeDisplaySettingsExW                   7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[4676] kernel32.dll!CreateThread + 1A                                 7C8106F1 4 Bytes  CALL 0044AD11 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtClose                                             7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtClose + 4                                         7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtCreateFile                                        7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtCreateFile                                        7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtCreateFile + 4                                    7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtCreateKey                                         7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtCreateKey + 4                                     7C90D0F2 2 Bytes  [05, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtCreateSection                                     7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtCreateSection + 4                                 7C90D182 2 Bytes  [23, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtDeleteKey                                         7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtDeleteKey + 4                                     7C90D252 2 Bytes  [0B, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtDeleteValueKey                                    7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtDeleteValueKey + 4                                7C90D272 2 Bytes  [11, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtRenameKey                                         7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtRenameKey + 4                                     7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtSetInformationFile                                7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtSetInformationFile + 4                            7C90DC62 2 Bytes  [20, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtSetValueKey                                       7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtSetValueKey + 4                                   7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtTerminateProcess                                  7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtTerminateProcess + 4                              7C90DE72 2 Bytes  [26, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtWriteFile                                         7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtWriteFile + 4                                     7C90DF82 2 Bytes  [1A, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtWriteFileGather                                   7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtWriteFileGather + 4                               7C90DF92 2 Bytes  [1D, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtWriteVirtualMemory                                7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] ntdll.dll!NtWriteVirtualMemory + 4                            7C90DFB2 2 Bytes  [29, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] kernel32.dll!LoadLibraryExW + C4                              7C801BB9 4 Bytes  CALL 00830001 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] USER32.dll!SetWindowsHookExW                                  7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[4716] USER32.dll!SetWindowsHookExA                                  7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtClose                                                    7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtClose + 4                                                7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtCreateFile                                               7C90D0AE 1 Byte  [FF]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtCreateFile                                               7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtCreateFile + 4                                           7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtCreateKey                                                7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtCreateKey + 4                                            7C90D0F2 2 Bytes  [05, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtCreateSection                                            7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtCreateSection + 4                                        7C90D182 2 Bytes  [23, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtDeleteKey                                                7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtDeleteKey + 4                                            7C90D252 2 Bytes  [0B, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtDeleteValueKey                                           7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtDeleteValueKey + 4                                       7C90D272 2 Bytes  [11, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtRenameKey                                                7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtRenameKey + 4                                            7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtSetInformationFile                                       7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtSetInformationFile + 4                                   7C90DC62 2 Bytes  [20, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtSetValueKey                                              7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtSetValueKey + 4                                          7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtTerminateProcess                                         7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtTerminateProcess + 4                                     7C90DE72 2 Bytes  [26, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtWriteFile                                                7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtWriteFile + 4                                            7C90DF82 2 Bytes  [1A, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtWriteFileGather                                          7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtWriteFileGather + 4                                      7C90DF92 2 Bytes  [1D, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtWriteVirtualMemory                                       7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] ntdll.dll!NtWriteVirtualMemory + 4                                   7C90DFB2 2 Bytes  [29, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] kernel32.dll!LoadLibraryExW + C4                                     7C801BB9 4 Bytes  CALL 00DC0001 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] USER32.dll!SetWindowsHookExW                                         7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe[4980] USER32.dll!SetWindowsHookExA                                         7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtClose                                                    7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtClose + 4                                                7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtCreateFile                                               7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtCreateFile                                               7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtCreateFile + 4                                           7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtCreateKey                                                7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtCreateKey + 4                                            7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtCreateSection                                            7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtCreateSection + 4                                        7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtDeleteKey                                                7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtDeleteKey + 4                                            7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtDeleteValueKey                                           7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtDeleteValueKey + 4                                       7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtRenameKey                                                7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtRenameKey + 4                                            7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtSetInformationFile                                       7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtSetInformationFile + 4                                   7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtSetValueKey                                              7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtSetValueKey + 4                                          7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtTerminateProcess                                         7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtTerminateProcess + 4                                     7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtWriteFile                                                7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtWriteFile + 4                                            7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtWriteFileGather                                          7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtWriteFileGather + 4                                      7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtWriteVirtualMemory                                       7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] ntdll.dll!NtWriteVirtualMemory + 4                                   7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] kernel32.dll!LoadLibraryExW + C4                                     7C801BB9 4 Bytes  CALL 007A0001 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] kernel32.dll!FreeLibrary + 15                                        7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] USER32.dll!SetWindowsHookExW                                         7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[5060] USER32.dll!SetWindowsHookExA                                         7E431211 6 Bytes  JMP 5F2E0F5A 
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtClose                                                 7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtClose + 4                                             7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtCreateFile                                            7C90D0AE 1 Byte  [FF]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtCreateFile                                            7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtCreateFile + 4                                        7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtCreateKey                                             7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtCreateKey + 4                                         7C90D0F2 2 Bytes  [05, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtCreateSection                                         7C90D17E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtCreateSection + 4                                     7C90D182 2 Bytes  [23, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtDeleteKey                                             7C90D24E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtDeleteKey + 4                                         7C90D252 2 Bytes  [0B, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtDeleteValueKey                                        7C90D26E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtDeleteValueKey + 4                                    7C90D272 2 Bytes  [11, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtRenameKey                                             7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtRenameKey + 4                                         7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtSetInformationFile                                    7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtSetInformationFile + 4                                7C90DC62 2 Bytes  [20, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtSetValueKey                                           7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtSetValueKey + 4                                       7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtTerminateProcess                                      7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtTerminateProcess + 4                                  7C90DE72 2 Bytes  [26, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtWriteFile                                             7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtWriteFile + 4                                         7C90DF82 2 Bytes  [1A, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtWriteFileGather                                       7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtWriteFileGather + 4                                   7C90DF92 2 Bytes  [1D, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtWriteVirtualMemory                                    7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] ntdll.dll!NtWriteVirtualMemory + 4                                7C90DFB2 2 Bytes  [29, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] kernel32.dll!LoadLibraryExW + C4                                  7C801BB9 4 Bytes  CALL 01560001 
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] USER32.dll!ChangeDisplaySettingsExA                               7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] USER32.dll!SetForegroundWindow                                    7E4242ED 6 Bytes  JMP 5F350F5A 
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] USER32.dll!SetWindowsHookExW                                      7E42820F 6 Bytes  JMP 5F320F5A 
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] USER32.dll!SetWindowPos                                           7E4299F3 3 Bytes  [FF, 25, 1E]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] USER32.dll!SetWindowPos + 4                                       7E4299F7 2 Bytes  [3A, 5F]
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] USER32.dll!SetWindowsHookExA                                      7E431211 6 Bytes  JMP 5F2E0F5A 
.text           c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe[5128] USER32.dll!ChangeDisplaySettingsExW                               7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 00AF0001 
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] kernel32.dll!FreeLibrary + 15                                              7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] USER32.dll!ChangeDisplaySettingsExA                                        7E42384E 6 Bytes  JMP 5F3C0F5A 
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] USER32.dll!SetForegroundWindow                                             7E4242ED 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] USER32.dll!SetWindowPos                                                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] USER32.dll!SetWindowPos + 4                                                7E4299F7 2 Bytes  [3A, 5F]
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\NOTEPAD.EXE[5252] USER32.dll!ChangeDisplaySettingsExW                                        7E4595BD 6 Bytes  JMP 5F3F0F5A 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtClose                                                          7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtClose + 4                                                      7C90CFF2 2 Bytes  [2D, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtCreateFile                                                     7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtCreateFile                                                     7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtCreateFile + 4                                                 7C90D0B2 2 Bytes  [18, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtCreateKey                                                      7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtCreateKey + 4                                                  7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtCreateSection                                                  7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtCreateSection + 4                                              7C90D182 2 Bytes  [24, 5F] {AND AL, 0x5f}
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtDeleteKey                                                      7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtDeleteKey + 4                                                  7C90D252 2 Bytes  [0C, 5F] {OR AL, 0x5f}
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtDeleteValueKey                                                 7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtDeleteValueKey + 4                                             7C90D272 2 Bytes  [12, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtRenameKey                                                      7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtRenameKey + 4                                                  7C90DA62 2 Bytes  [15, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtSetInformationFile                                             7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtSetInformationFile + 4                                         7C90DC62 2 Bytes  [21, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtSetValueKey                                                    7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtSetValueKey + 4                                                7C90DDD2 2 Bytes  [0F, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtTerminateProcess                                               7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtTerminateProcess + 4                                           7C90DE72 2 Bytes  [27, 5F] {DAA ; POP EDI}
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtWriteFile                                                      7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtWriteFile + 4                                                  7C90DF82 2 Bytes  [1B, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtWriteFileGather                                                7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtWriteFileGather + 4                                            7C90DF92 2 Bytes  [1E, 5F] {PUSH DS; POP EDI}
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtWriteVirtualMemory                                             7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ntdll.dll!NtWriteVirtualMemory + 4                                         7C90DFB2 2 Bytes  [2A, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!CreateFileA                                                   7C801A28 5 Bytes  JMP 001B0FEF 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 001B007B 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 001B0F7C 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!LoadLibraryExW                                                7C801AF5 5 Bytes  JMP 001B0060 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!LoadLibraryExA                                                7C801D53 5 Bytes  JMP 001B0F97 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!LoadLibraryA                                                  7C801D7B 5 Bytes  JMP 001B0FC3 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!GetStartupInfoW                                               7C801E54 5 Bytes  JMP 001B00A7 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!GetStartupInfoA                                               7C801EF2 5 Bytes  JMP 001B008C 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 001B00DD 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 001B00B8 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!FreeLibrary + 15                                              7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!GetProcAddress                                                7C80AE40 5 Bytes  JMP 001B0F1F 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!LoadLibraryW                                                  7C80AEEB 5 Bytes  JMP 001B0FA8 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!CreateFileW                                                   7C810800 5 Bytes  JMP 001B0014 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!CreatePipe                                                    7C81D83F 5 Bytes  JMP 001B0F6B 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!CreateNamedPipeW                                              7C82F0DD 5 Bytes  JMP 001B0FDE 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!CreateNamedPipeA                                              7C860CDC 5 Bytes  JMP 001B002F 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 001B0F3A 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] msvcrt.dll!_wsystem                                                        77C2931E 5 Bytes  JMP 002A0FA3 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] msvcrt.dll!system                                                          77C293C7 5 Bytes  JMP 002A0038 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] msvcrt.dll!_creat                                                          77C2D40F 5 Bytes  JMP 002A001D 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] msvcrt.dll!_open                                                           77C2F566 5 Bytes  JMP 002A0FEF 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] msvcrt.dll!_wcreat                                                         77C2FC9B 5 Bytes  JMP 002A0FC8 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] msvcrt.dll!_wopen                                                          77C30055 5 Bytes  JMP 002A000C 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegOpenKeyExW                                                 77DD6AAF 5 Bytes  JMP 002B0FCA 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegCreateKeyExW                                               77DD776C 5 Bytes  JMP 002B0F97 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 5 Bytes  JMP 002B0FE5 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegOpenKeyW                                                   77DD7946 5 Bytes  JMP 002B0025 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 5 Bytes  JMP 002B0054 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegOpenKeyA                                                   77DDEFC8 5 Bytes  JMP 002B0000 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegCreateKeyW                                                 77DFBA55 2 Bytes  JMP 002B0FA8 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegCreateKeyW + 3                                             77DFBA58 2 Bytes  [4B, 88]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] ADVAPI32.dll!RegCreateKeyA                                                 77DFBCF3 5 Bytes  JMP 002B0FB9 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] USER32.dll!ChangeDisplaySettingsExA                                        7E42384E 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] USER32.dll!SetForegroundWindow                                             7E4242ED 6 Bytes  JMP 5F360F5A 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F330F5A 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] USER32.dll!SetWindowPos                                                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] USER32.dll!SetWindowPos + 4                                                7E4299F7 2 Bytes  [3B, 5F]
.text           C:\WINDOWS\system32\wuauclt.exe[5412] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F2F0F5A 
.text           C:\WINDOWS\system32\wuauclt.exe[5412] USER32.dll!ChangeDisplaySettingsExW                                        7E4595BD 6 Bytes  JMP 5F400F5A 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtClose                                                 7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtClose + 4                                             7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtCreateFile                                            7C90D0AE 1 Byte  [FF]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtCreateFile                                            7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtCreateFile + 4                                        7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtCreateKey                                             7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtCreateKey + 4                                         7C90D0F2 2 Bytes  [05, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtCreateSection                                         7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtCreateSection + 4                                     7C90D182 2 Bytes  [23, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtDeleteKey                                             7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtDeleteKey + 4                                         7C90D252 2 Bytes  [0B, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtDeleteValueKey                                        7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtDeleteValueKey + 4                                    7C90D272 2 Bytes  [11, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtRenameKey                                             7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtRenameKey + 4                                         7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtSetInformationFile                                    7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtSetInformationFile + 4                                7C90DC62 2 Bytes  [20, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtSetValueKey                                           7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtSetValueKey + 4                                       7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtTerminateProcess                                      7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtTerminateProcess + 4                                  7C90DE72 2 Bytes  [26, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtWriteFile                                             7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtWriteFile + 4                                         7C90DF82 2 Bytes  [1A, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtWriteFileGather                                       7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtWriteFileGather + 4                                   7C90DF92 2 Bytes  [1D, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtWriteVirtualMemory                                    7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] ntdll.dll!NtWriteVirtualMemory + 4                                7C90DFB2 2 Bytes  [29, 5F]
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] kernel32.dll!LoadLibraryExW + C4                                  7C801BB9 4 Bytes  CALL 01120001 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] USER32.dll!SetWindowsHookExW                                      7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5716] USER32.dll!SetWindowsHookExA                                      7E431211 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtClose                                                    7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtClose + 4                                                7C90CFF2 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtCreateFile                                               7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtCreateFile                                               7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtCreateFile + 4                                           7C90D0B2 2 Bytes  [17, 5F] {POP SS; POP EDI}
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtCreateKey                                                7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtCreateKey + 4                                            7C90D0F2 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtCreateSection                                            7C90D17E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtCreateSection + 4                                        7C90D182 2 Bytes  [23, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtDeleteKey                                                7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtDeleteKey + 4                                            7C90D252 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtDeleteValueKey                                           7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtDeleteValueKey + 4                                       7C90D272 2 Bytes  [11, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtRenameKey                                                7C90DA5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtRenameKey + 4                                            7C90DA62 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtSetInformationFile                                       7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtSetInformationFile + 4                                   7C90DC62 2 Bytes  [20, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtSetValueKey                                              7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtSetValueKey + 4                                          7C90DDD2 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtTerminateProcess                                         7C90DE6E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtTerminateProcess + 4                                     7C90DE72 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtWriteFile                                                7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtWriteFile + 4                                            7C90DF82 2 Bytes  [1A, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtWriteFileGather                                          7C90DF8E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtWriteFileGather + 4                                      7C90DF92 2 Bytes  [1D, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtWriteVirtualMemory                                       7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] ntdll.dll!NtWriteVirtualMemory + 4                                   7C90DFB2 2 Bytes  [29, 5F]
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] kernel32.dll!LoadLibraryExW + C4                                     7C801BB9 4 Bytes  CALL 00CB0001 
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] kernel32.dll!FreeLibrary + 15                                        7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] USER32.dll!SetWindowsHookExW                                         7E42820F 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\system32\wbem\unsecapp.exe[5928] USER32.dll!SetWindowsHookExA                                         7E431211 6 Bytes  JMP 5F2E0F5A 

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\WINDOWS\system32\services.exe[832] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\services.exe[832] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\services.exe[832] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\services.exe[832] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\lsass.exe[844] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\lsass.exe[844] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                5F080000
IAT             C:\WINDOWS\system32\lsass.exe[844] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]                 5F080000
IAT             C:\WINDOWS\system32\lsass.exe[844] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]                 5F080000
IAT             C:\WINDOWS\system32\lsass.exe[844] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]               5F080000
IAT             C:\WINDOWS\system32\lsass.exe[844] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]               5F080000
IAT             C:\WINDOWS\system32\lsass.exe[844] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]               5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\Explorer.EXE [KERNEL32.dll!LoadLibraryExW]                             5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]                    5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]                       5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                      5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]                       5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]                     5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]                     5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW]                     5F080000
IAT             C:\WINDOWS\Explorer.EXE[964] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]                     5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ c:\windows\system32\rpcss.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1016] @ c:\windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1084] @ c:\windows\system32\rpcss.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ c:\windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[1192] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1288] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1288] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1288] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1288] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1288] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1288] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1288] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1356] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1356] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1356] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1356] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1356] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1356] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1356] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[1828] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\svchost.exe[2156] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\System32\svchost.exe[2256] @ C:\WINDOWS\System32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\wuauclt.exe[5412] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\wuauclt.exe[5412] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]           5F080000
IAT             C:\WINDOWS\system32\wuauclt.exe[5412] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]              5F080000
IAT             C:\WINDOWS\system32\wuauclt.exe[5412] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]             5F080000
IAT             C:\WINDOWS\system32\wuauclt.exe[5412] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\wuauclt.exe[5412] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000
IAT             C:\WINDOWS\system32\wuauclt.exe[5412] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]            5F080000

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                           mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                         Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                          wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                          wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                        Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                        Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                      Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device          \FileSystem\Fastfat \Fat                                                                                         93D34D20

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                         fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                         mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

---- EOF - GMER 1.0.15 ----
