GMER 1.0.15.15273 - http://www.gmer.net
Rootkit scan 2009-12-09 07:20:00
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\uftcypow.sys


---- System - GMER 1.0.15 ----

SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwAssignProcessToJobObject [0xB2708CEC]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwCreateFile [0xB27093F8]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwCreateKey [0xF7459D72]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwCreateProcess [0xF743A9A6]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwCreateProcessEx [0xF743AB98]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwDeleteFile [0xB2709544]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwDeleteKey [0xF745A568]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwDeleteValueKey [0xF745A820]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwOpenFile [0xB27094A8]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwOpenKey [0xF7458A80]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwOpenProcess [0xB2708E30]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwOpenThread [0xB2709022]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwProtectVirtualMemory [0xB2709154]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwQueryValueKey [0xB270CCE4]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwRenameKey [0xF745AC8A]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwReplaceKey [0xB270CC80]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwRestoreKey [0xB270CCB2]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwSetContextThread [0xB2708C9A]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwSetInformationFile [0xB27095A4]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwSetValueKey [0xF745A036]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwSuspendThread [0xB2708C3E]
SSDT            PCTCore.sys (PC Tools KDS Core Driver/PC Tools)                                                                                      ZwTerminateProcess [0xF743A656]
SSDT            \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.)                                                    ZwTerminateThread [0xB2708BE2]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!_abnormal_termination + 3CD                                                                                             804E2A29 3 Bytes  [95, 70, B2] {XCHG EBP, EAX; JO 0xffffffffffffffb5}
?               C:\WINDOWS\system32\Drivers\mchInjDrv.sys                                                                                            The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ntdll.dll!NtLoadDriver                                                             7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ntdll.dll!NtLoadDriver + 4                                                         7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ntdll.dll!NtSuspendProcess                                                         7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ntdll.dll!NtSuspendProcess + 4                                                     7C90DE32 2 Bytes  [38, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateFileA                                                           7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!VirtualProtect                                                        7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!LoadLibraryExW                                                        7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!LoadLibraryA                                                          7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!TerminateProcess                                                      7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!WriteProcessMemory                                                    7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateProcessW                                                        7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateProcessA                                                        7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!LoadResource                                                          7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!GetProcAddress                                                        7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!LoadLibraryW                                                          7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateRemoteThread                                                    7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateRemoteThread + 4                                                7C8104D0 2 Bytes  [05, 5F]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateThread                                                          7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateFileW                                                           7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!TerminateThread                                                       7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!GetVolumeInformationA                                                 7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!DebugActiveProcess                                                    7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!WinExec                                                               7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] kernel32.dll!CreateToolhelp32Snapshot                                              7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ADVAPI32.dll!RegOpenKeyExA                                                         77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ADVAPI32.dll!RegCreateKeyExA                                                       77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ADVAPI32.dll!RegSetValueExA                                                        77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ADVAPI32.dll!OpenSCManagerA                                                        77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ADVAPI32.dll!OpenSCManagerA + 4                                                    77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ADVAPI32.dll!LsaRemoveAccountRights                                                77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] ADVAPI32.dll!CreateServiceA                                                        77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!SetWindowsHookExW                                                       7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!GetKeyState                                                             7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!GetAsyncKeyState                                                        7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!ShowWindow                                                              7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!ShowWindow + 4                                                          7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!SetWindowsHookExA                                                       7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!SetWinEventHook                                                         7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!GetWindowTextA                                                          7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!DdeConnect                                                              7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!EndTask                                                                 7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!RegisterRawInputDevices                                                 7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] USER32.dll!RegisterRawInputDevices + 4                                             7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] SHELL32.dll!ShellExecuteExW                                                        7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] SHELL32.dll!ShellExecuteEx                                                         7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] SHELL32.dll!ShellExecuteA                                                          7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Spyware Doctor\pctsAuxs.exe[200] SHELL32.dll!ShellExecuteW                                                          7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] ntdll.dll!NtLoadDriver                                                                          7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\brss01a.exe[216] ntdll.dll!NtLoadDriver + 4                                                                      7C90D472 2 Bytes  [3E, 5F]
.text           C:\WINDOWS\System32\brss01a.exe[216] ntdll.dll!NtSuspendProcess                                                                      7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\brss01a.exe[216] ntdll.dll!NtSuspendProcess + 4                                                                  7C90DE32 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateFileA                                                                        7C801A28 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!VirtualProtect                                                                     7C801AD4 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!LoadLibraryExW                                                                     7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!LoadLibraryA                                                                       7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!TerminateProcess                                                                   7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!WriteProcessMemory                                                                 7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateProcessW                                                                     7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateProcessA                                                                     7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!LoadResource                                                                       7C80A055 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!GetProcAddress                                                                     7C80AE40 6 Bytes  JMP 5F490F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!LoadLibraryW                                                                       7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateRemoteThread                                                                 7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateRemoteThread + 4                                                             7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateThread                                                                       7C8106D7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateFileW                                                                        7C810800 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!TerminateThread                                                                    7C81CB3B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!GetVolumeInformationA                                                              7C821BA5 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!DebugActiveProcess                                                                 7C85B0FB 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!WinExec                                                                            7C86250D 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] kernel32.dll!CreateToolhelp32Snapshot                                                           7C865C7F 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!SetWindowsHookExW                                                                    7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!GetKeyState                                                                          7E429ED9 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!GetAsyncKeyState                                                                     7E42A78F 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!ShowWindow                                                                           7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!ShowWindow + 4                                                                       7E42AF5A 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!SetWindowsHookExA                                                                    7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!SetWinEventHook                                                                      7E4317F7 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!GetWindowTextA                                                                       7E43216B 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!DdeConnect                                                                           7E4581C3 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!EndTask                                                                              7E45A0A5 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!RegisterRawInputDevices                                                              7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\brss01a.exe[216] USER32.dll!RegisterRawInputDevices + 4                                                          7E46CE12 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\System32\brss01a.exe[216] ADVAPI32.dll!RegOpenKeyExA                                                                      77DD7852 6 Bytes  JMP 5F520F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] ADVAPI32.dll!RegCreateKeyExA                                                                    77DDE9F4 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] ADVAPI32.dll!RegSetValueExA                                                                     77DDEAE7 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] ADVAPI32.dll!OpenSCManagerA                                                                     77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\brss01a.exe[216] ADVAPI32.dll!OpenSCManagerA + 4                                                                 77DF69B2 2 Bytes  [68, 5F]
.text           C:\WINDOWS\System32\brss01a.exe[216] ADVAPI32.dll!LsaRemoveAccountRights                                                             77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\System32\brss01a.exe[216] ADVAPI32.dll!CreateServiceA                                                                     77E37211 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] ntdll.dll!NtLoadDriver                                                                          7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[244] ntdll.dll!NtLoadDriver + 4                                                                      7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\spoolsv.exe[244] ntdll.dll!NtSuspendProcess                                                                      7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[244] ntdll.dll!NtSuspendProcess + 4                                                                  7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateFileA                                                                        7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!VirtualProtect                                                                     7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!LoadLibraryExW                                                                     7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!LoadLibraryA                                                                       7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!TerminateProcess                                                                   7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!WriteProcessMemory                                                                 7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateProcessW                                                                     7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateProcessA                                                                     7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!LoadResource                                                                       7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!GetProcAddress                                                                     7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!LoadLibraryW                                                                       7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateRemoteThread                                                                 7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateRemoteThread + 4                                                             7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateThread                                                                       7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateFileW                                                                        7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!TerminateThread                                                                    7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!GetVolumeInformationA                                                              7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!DebugActiveProcess                                                                 7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!WinExec                                                                            7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] kernel32.dll!CreateToolhelp32Snapshot                                                           7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] ADVAPI32.dll!RegOpenKeyExA                                                                      77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] ADVAPI32.dll!RegCreateKeyExA                                                                    77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] ADVAPI32.dll!RegSetValueExA                                                                     77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] ADVAPI32.dll!OpenSCManagerA                                                                     77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[244] ADVAPI32.dll!OpenSCManagerA + 4                                                                 77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\spoolsv.exe[244] ADVAPI32.dll!LsaRemoveAccountRights                                                             77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] ADVAPI32.dll!CreateServiceA                                                                     77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!SetWindowsHookExW                                                                    7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!GetKeyState                                                                          7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!GetAsyncKeyState                                                                     7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!ShowWindow                                                                           7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!ShowWindow + 4                                                                       7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!SetWindowsHookExA                                                                    7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!SetWinEventHook                                                                      7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!GetWindowTextA                                                                       7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!DdeConnect                                                                           7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!EndTask                                                                              7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!RegisterRawInputDevices                                                              7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\spoolsv.exe[244] USER32.dll!RegisterRawInputDevices + 4                                                          7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\spoolsv.exe[244] SHELL32.dll!ShellExecuteExW                                                                     7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] SHELL32.dll!ShellExecuteEx                                                                      7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] SHELL32.dll!ShellExecuteA                                                                       7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\spoolsv.exe[244] SHELL32.dll!ShellExecuteW                                                                       7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ntdll.dll!NtLoadDriver                                                              7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ntdll.dll!NtLoadDriver + 4                                                          7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ntdll.dll!NtSuspendProcess                                                          7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ntdll.dll!NtSuspendProcess + 4                                                      7C90DE32 2 Bytes  [38, 5F]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateFileA                                                            7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!VirtualProtect                                                         7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!LoadLibraryExW                                                         7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!LoadLibraryA                                                           7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!TerminateProcess                                                       7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!WriteProcessMemory                                                     7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateProcessW                                                         7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateProcessA                                                         7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!LoadResource                                                           7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!GetProcAddress                                                         7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!LoadLibraryW                                                           7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateRemoteThread                                                     7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateRemoteThread + 4                                                 7C8104D0 2 Bytes  [05, 5F]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateThread                                                           7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateThread + 1A                                                      7C8106F1 4 Bytes  CALL 0044AD11 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateFileW                                                            7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!TerminateThread                                                        7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!GetVolumeInformationA                                                  7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!DebugActiveProcess                                                     7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!WinExec                                                                7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] kernel32.dll!CreateToolhelp32Snapshot                                               7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ADVAPI32.dll!RegOpenKeyExA                                                          77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ADVAPI32.dll!RegCreateKeyExA                                                        77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ADVAPI32.dll!RegSetValueExA                                                         77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ADVAPI32.dll!OpenSCManagerA                                                         77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ADVAPI32.dll!OpenSCManagerA + 4                                                     77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ADVAPI32.dll!LsaRemoveAccountRights                                                 77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] ADVAPI32.dll!CreateServiceA                                                         77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!SetWindowsHookExW                                                        7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!GetKeyState                                                              7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!GetAsyncKeyState                                                         7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!ShowWindow                                                               7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!ShowWindow + 4                                                           7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!SetWindowsHookExA                                                        7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!SetWinEventHook                                                          7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!GetWindowTextA                                                           7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!DdeConnect                                                               7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!EndTask                                                                  7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!RegisterRawInputDevices                                                  7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] USER32.dll!RegisterRawInputDevices + 4                                              7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] shell32.dll!ShellExecuteExW                                                         7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] shell32.dll!ShellExecuteEx                                                          7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] shell32.dll!ShellExecuteA                                                           7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Spyware Doctor\pctsSvc.exe[328] shell32.dll!ShellExecuteW                                                           7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ntdll.dll!NtLoadDriver                                                             7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ntdll.dll!NtLoadDriver + 4                                                         7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ntdll.dll!NtSuspendProcess                                                         7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ntdll.dll!NtSuspendProcess + 4                                                     7C90DE32 2 Bytes  [38, 5F]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateFileA                                                           7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!VirtualProtect                                                        7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!LoadLibraryExW                                                        7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!LoadLibraryA                                                          7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!TerminateProcess                                                      7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!WriteProcessMemory                                                    7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateProcessW                                                        7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateProcessA                                                        7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!LoadResource                                                          7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!GetProcAddress                                                        7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!LoadLibraryW                                                          7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateRemoteThread                                                    7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateRemoteThread + 4                                                7C8104D0 2 Bytes  [05, 5F]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateThread                                                          7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateThread + 1B                                                     7C8106F2 3 Bytes  CALL 0044ACCE C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateFileW                                                           7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!TerminateThread                                                       7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!GetVolumeInformationA                                                 7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!DebugActiveProcess                                                    7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!WinExec                                                               7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] kernel32.dll!CreateToolhelp32Snapshot                                              7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ADVAPI32.dll!RegOpenKeyExA                                                         77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ADVAPI32.dll!RegCreateKeyExA                                                       77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ADVAPI32.dll!RegSetValueExA                                                        77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ADVAPI32.dll!OpenSCManagerA                                                        77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ADVAPI32.dll!OpenSCManagerA + 4                                                    77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ADVAPI32.dll!LsaRemoveAccountRights                                                77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] ADVAPI32.dll!CreateServiceA                                                        77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!SetWindowsHookExW                                                       7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!GetKeyState                                                             7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!GetAsyncKeyState                                                        7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!ShowWindow                                                              7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!ShowWindow + 4                                                          7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!SetWindowsHookExA                                                       7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!SetWinEventHook                                                         7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!GetWindowTextA                                                          7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!DdeConnect                                                              7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!EndTask                                                                 7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!RegisterRawInputDevices                                                 7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] USER32.dll!RegisterRawInputDevices + 4                                             7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] shell32.dll!ShellExecuteExW                                                        7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] shell32.dll!ShellExecuteEx                                                         7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] shell32.dll!ShellExecuteA                                                          7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Spyware Doctor\pctsTray.exe[428] shell32.dll!ShellExecuteW                                                          7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] ntdll.dll!NtLoadDriver                                                                           7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[532] ntdll.dll!NtLoadDriver + 4                                                                       7C90D472 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[532] ntdll.dll!NtSuspendProcess                                                                       7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[532] ntdll.dll!NtSuspendProcess + 4                                                                   7C90DE32 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateFileA                                                                         7C801A28 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!VirtualProtect                                                                      7C801AD4 6 Bytes  JMP 5F7F0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!LoadLibraryExW                                                                      7C801AF5 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!LoadLibraryExW + C4                                                                 7C801BB9 4 Bytes  CALL 00EA0001 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!LoadLibraryA                                                                        7C801D7B 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!TerminateProcess                                                                    7C801E1A 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!WriteProcessMemory                                                                  7C802213 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateProcessW                                                                      7C802336 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateProcessA                                                                      7C80236B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!LoadResource                                                                        7C80A055 6 Bytes  JMP 5F8B0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!GetProcAddress                                                                      7C80AE40 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!LoadLibraryW                                                                        7C80AEEB 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateRemoteThread                                                                  7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateRemoteThread + 4                                                              7C8104D0 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateThread                                                                        7C8106D7 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateFileW                                                                         7C810800 6 Bytes  JMP 5F730F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!TerminateThread                                                                     7C81CB3B 6 Bytes  JMP 5F490F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!GetVolumeInformationA                                                               7C821BA5 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!DebugActiveProcess                                                                  7C85B0FB 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!WinExec                                                                             7C86250D 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] kernel32.dll!CreateToolhelp32Snapshot                                                            7C865C7F 6 Bytes  JMP 5F790F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] ADVAPI32.dll!RegOpenKeyExA                                                                       77DD7852 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] ADVAPI32.dll!RegCreateKeyExA                                                                     77DDE9F4 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] ADVAPI32.dll!RegSetValueExA                                                                      77DDEAE7 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] ADVAPI32.dll!OpenSCManagerA                                                                      77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[532] ADVAPI32.dll!OpenSCManagerA + 4                                                                  77DF69B2 2 Bytes  [83, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[532] ADVAPI32.dll!LsaRemoveAccountRights                                                              77E1AC91 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] ADVAPI32.dll!CreateServiceA                                                                      77E37211 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!ChangeDisplaySettingsExA                                                              7E42384E 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!SetForegroundWindow                                                                   7E4242ED 6 Bytes  JMP 5F040F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!SetWindowsHookExW                                                                     7E42820F 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!SetWindowPos                                                                          7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!SetWindowPos + 4                                                                      7E4299F7 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!GetKeyState                                                                           7E429ED9 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!GetAsyncKeyState                                                                      7E42A78F 6 Bytes  JMP 5F520F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!ShowWindow                                                                            7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!ShowWindow + 4                                                                        7E42AF5A 2 Bytes  [89, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!SetWindowsHookExA                                                                     7E431211 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!SetWinEventHook                                                                       7E4317F7 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!GetWindowTextA                                                                        7E43216B 6 Bytes  JMP 5F850F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!DdeConnect                                                                            7E4581C3 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!ChangeDisplaySettingsExW                                                              7E4595BD 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!EndTask                                                                               7E45A0A5 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!RegisterRawInputDevices                                                               7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[532] USER32.dll!RegisterRawInputDevices + 4                                                           7E46CE12 2 Bytes  [62, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[532] SHELL32.dll!ShellExecuteExW                                                                      7CA0996B 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] SHELL32.dll!ShellExecuteEx                                                                       7CA40EB5 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] SHELL32.dll!ShellExecuteA                                                                        7CA411E0 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[532] SHELL32.dll!ShellExecuteW                                                                        7CAB5D48 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\Explorer.EXE[636] ntdll.dll!NtLoadDriver                                                                                  7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[636] ntdll.dll!NtLoadDriver + 4                                                                              7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\Explorer.EXE[636] ntdll.dll!NtSuspendProcess                                                                              7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[636] ntdll.dll!NtSuspendProcess + 4                                                                          7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateFileA                                                                                7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!VirtualProtect                                                                             7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!LoadLibraryExW                                                                             7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!LoadLibraryA                                                                               7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!TerminateProcess                                                                           7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!WriteProcessMemory                                                                         7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateProcessW                                                                             7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateProcessA                                                                             7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!LoadResource                                                                               7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!GetProcAddress                                                                             7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!LoadLibraryW                                                                               7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateRemoteThread                                                                         7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateRemoteThread + 4                                                                     7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateThread                                                                               7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateFileW                                                                                7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!TerminateThread                                                                            7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!GetVolumeInformationA                                                                      7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!DebugActiveProcess                                                                         7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!WinExec                                                                                    7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\Explorer.EXE[636] kernel32.dll!CreateToolhelp32Snapshot                                                                   7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] ADVAPI32.dll!RegOpenKeyExA                                                                              77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] ADVAPI32.dll!RegCreateKeyExA                                                                            77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] ADVAPI32.dll!RegSetValueExA                                                                             77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\Explorer.EXE[636] ADVAPI32.dll!OpenSCManagerA                                                                             77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[636] ADVAPI32.dll!OpenSCManagerA + 4                                                                         77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\Explorer.EXE[636] ADVAPI32.dll!LsaRemoveAccountRights                                                                     77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] ADVAPI32.dll!CreateServiceA                                                                             77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!SetWindowsHookExW                                                                            7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!GetKeyState                                                                                  7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!GetAsyncKeyState                                                                             7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!ShowWindow                                                                                   7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!ShowWindow + 4                                                                               7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!SetWindowsHookExA                                                                            7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!SetWinEventHook                                                                              7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!GetWindowTextA                                                                               7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!DdeConnect                                                                                   7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!EndTask                                                                                      7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!RegisterRawInputDevices                                                                      7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\Explorer.EXE[636] USER32.dll!RegisterRawInputDevices + 4                                                                  7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\Explorer.EXE[636] SHELL32.dll!ShellExecuteExW                                                                             7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] SHELL32.dll!ShellExecuteEx                                                                              7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\Explorer.EXE[636] SHELL32.dll!ShellExecuteA                                                                               7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\Explorer.EXE[636] SHELL32.dll!ShellExecuteW                                                                               7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] ntdll.dll!NtLoadDriver                                                    7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] ntdll.dll!NtLoadDriver + 4                                                7C90D472 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] ntdll.dll!NtSuspendProcess                                                7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] ntdll.dll!NtSuspendProcess + 4                                            7C90DE32 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateFileA                                                  7C801A28 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!VirtualProtect                                               7C801AD4 6 Bytes  JMP 5F7F0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!LoadLibraryExW                                               7C801AF5 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!LoadLibraryExW + C4                                          7C801BB9 4 Bytes  CALL 00A70001 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!LoadLibraryA                                                 7C801D7B 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!TerminateProcess                                             7C801E1A 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!WriteProcessMemory                                           7C802213 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateProcessW                                               7C802336 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateProcessA                                               7C80236B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!LoadResource                                                 7C80A055 6 Bytes  JMP 5F8B0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!FreeLibrary + 15                                             7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!GetProcAddress                                               7C80AE40 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!LoadLibraryW                                                 7C80AEEB 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateRemoteThread                                           7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateRemoteThread + 4                                       7C8104D0 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateThread                                                 7C8106D7 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateFileW                                                  7C810800 6 Bytes  JMP 5F730F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!TerminateThread                                              7C81CB3B 6 Bytes  JMP 5F490F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!GetVolumeInformationA                                        7C821BA5 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!DebugActiveProcess                                           7C85B0FB 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!WinExec                                                      7C86250D 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] kernel32.dll!CreateToolhelp32Snapshot                                     7C865C7F 6 Bytes  JMP 5F790F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!ChangeDisplaySettingsExA                                       7E42384E 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!SetForegroundWindow                                            7E4242ED 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!SetWindowsHookExW                                              7E42820F 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!SetWindowPos                                                   7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!SetWindowPos + 4                                               7E4299F7 2 Bytes  [0B, 5F]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!GetKeyState                                                    7E429ED9 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!GetAsyncKeyState                                               7E42A78F 6 Bytes  JMP 5F520F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!ShowWindow                                                     7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!ShowWindow + 4                                                 7E42AF5A 2 Bytes  [89, 5F]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!SetWindowsHookExA                                              7E431211 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!SetWinEventHook                                                7E4317F7 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!GetWindowTextA                                                 7E43216B 6 Bytes  JMP 5F850F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!DdeConnect                                                     7E4581C3 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!ChangeDisplaySettingsExW                                       7E4595BD 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!EndTask                                                        7E45A0A5 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!RegisterRawInputDevices                                        7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] user32.dll!RegisterRawInputDevices + 4                                    7E46CE12 2 Bytes  [62, 5F]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] advapi32.dll!RegOpenKeyExA                                                77DD7852 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] advapi32.dll!RegCreateKeyExA                                              77DDE9F4 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] advapi32.dll!RegSetValueExA                                               77DDEAE7 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] advapi32.dll!OpenSCManagerA                                               77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] advapi32.dll!OpenSCManagerA + 4                                           77DF69B2 2 Bytes  [83, 5F]
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] advapi32.dll!LsaRemoveAccountRights                                       77E1AC91 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] advapi32.dll!CreateServiceA                                               77E37211 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] SHELL32.dll!ShellExecuteExW                                               7CA0996B 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] SHELL32.dll!ShellExecuteEx                                                7CA40EB5 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] SHELL32.dll!ShellExecuteA                                                 7CA411E0 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\CoffeeCup Software\FreeZip\cczip.exe[740] SHELL32.dll!ShellExecuteW                                                 7CAB5D48 6 Bytes  JMP 5F370F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ntdll.dll!NtLoadDriver                                                          7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ntdll.dll!NtLoadDriver + 4                                                      7C90D472 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ntdll.dll!NtSuspendProcess                                                      7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ntdll.dll!NtSuspendProcess + 4                                                  7C90DE32 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateFileA                                                        7C801A28 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!VirtualProtect                                                     7C801AD4 6 Bytes  JMP 5F7F0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!LoadLibraryExW                                                     7C801AF5 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!LoadLibraryExW + C4                                                7C801BB9 4 Bytes  CALL 01CD0001 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!LoadLibraryA                                                       7C801D7B 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!TerminateProcess                                                   7C801E1A 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!WriteProcessMemory                                                 7C802213 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateProcessW                                                     7C802336 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateProcessA                                                     7C80236B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!LoadResource                                                       7C80A055 6 Bytes  JMP 5F8D0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!GetProcAddress                                                     7C80AE40 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!LoadLibraryW                                                       7C80AEEB 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateRemoteThread                                                 7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateRemoteThread + 4                                             7C8104D0 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateThread                                                       7C8106D7 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateFileW                                                        7C810800 6 Bytes  JMP 5F730F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!TerminateThread                                                    7C81CB3B 6 Bytes  JMP 5F490F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!GetVolumeInformationA                                              7C821BA5 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!DebugActiveProcess                                                 7C85B0FB 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!WinExec                                                            7C86250D 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] kernel32.dll!CreateToolhelp32Snapshot                                           7C865C7F 6 Bytes  JMP 5F790F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ADVAPI32.dll!RegOpenKeyExA                                                      77DD7852 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ADVAPI32.dll!RegCreateKeyExA                                                    77DDE9F4 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ADVAPI32.dll!RegSetValueExA                                                     77DDEAE7 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ADVAPI32.dll!OpenSCManagerA                                                     77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ADVAPI32.dll!OpenSCManagerA + 4                                                 77DF69B2 2 Bytes  [85, 5F]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ADVAPI32.dll!LsaRemoveAccountRights                                             77E1AC91 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] ADVAPI32.dll!CreateServiceA                                                     77E37211 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!ChangeDisplaySettingsExA                                             7E42384E 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!SetForegroundWindow                                                  7E4242ED 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!SetWindowsHookExW                                                    7E42820F 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!SetWindowPos                                                         7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!SetWindowPos + 4                                                     7E4299F7 2 Bytes  [0B, 5F]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!GetKeyState                                                          7E429ED9 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!GetAsyncKeyState                                                     7E42A78F 6 Bytes  JMP 5F520F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!ShowWindow                                                           7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!ShowWindow + 4                                                       7E42AF5A 2 Bytes  [8B, 5F]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!SetWindowsHookExA                                                    7E431211 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!SetWinEventHook                                                      7E4317F7 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!GetWindowTextA                                                       7E43216B 6 Bytes  JMP 5F870F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!DdeConnect                                                           7E4581C3 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!ChangeDisplaySettingsExW                                             7E4595BD 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!EndTask                                                              7E45A0A5 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!RegisterRawInputDevices                                              7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] USER32.dll!RegisterRawInputDevices + 4                                          7E46CE12 2 Bytes  [62, 5F]
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] SHELL32.dll!ShellExecuteExW                                                     7CA0996B 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] SHELL32.dll!ShellExecuteEx                                                      7CA40EB5 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] SHELL32.dll!ShellExecuteA                                                       7CA411E0 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Logitech\SetPoint\SetPoint.exe[792] SHELL32.dll!ShellExecuteW                                                       7CAB5D48 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] ntdll.dll!NtLoadDriver                                                                          7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[876] ntdll.dll!NtLoadDriver + 4                                                                      7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[876] ntdll.dll!NtSuspendProcess                                                                      7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[876] ntdll.dll!NtSuspendProcess + 4                                                                  7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateFileA                                                                        7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!VirtualProtect                                                                     7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!LoadLibraryExW                                                                     7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!LoadLibraryA                                                                       7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!TerminateProcess                                                                   7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!WriteProcessMemory                                                                 7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateProcessW                                                                     7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateProcessA                                                                     7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!LoadResource                                                                       7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!GetProcAddress                                                                     7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!LoadLibraryW                                                                       7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateRemoteThread                                                                 7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateRemoteThread + 4                                                             7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateThread                                                                       7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateFileW                                                                        7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!TerminateThread                                                                    7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!GetVolumeInformationA                                                              7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!DebugActiveProcess                                                                 7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!WinExec                                                                            7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateToolhelp32Snapshot                                                           7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!RegOpenKeyExA                                                                      77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!RegCreateKeyExA                                                                    77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!RegSetValueExA                                                                     77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!OpenSCManagerA                                                                     77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!OpenSCManagerA + 4                                                                 77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!LsaRemoveAccountRights                                                             77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!CreateServiceA                                                                     77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!SetWindowsHookExW                                                                    7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!GetKeyState                                                                          7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!GetAsyncKeyState                                                                     7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!ShowWindow                                                                           7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!ShowWindow + 4                                                                       7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!SetWindowsHookExA                                                                    7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!SetWinEventHook                                                                      7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!GetWindowTextA                                                                       7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!DdeConnect                                                                           7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!EndTask                                                                              7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!RegisterRawInputDevices                                                              7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[876] USER32.dll!RegisterRawInputDevices + 4                                                          7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[876] SHELL32.dll!ShellExecuteExW                                                                     7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] SHELL32.dll!ShellExecuteEx                                                                      7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] SHELL32.dll!ShellExecuteA                                                                       7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\svchost.exe[876] SHELL32.dll!ShellExecuteW                                                                       7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] ntdll.dll!NtLoadDriver                                                                          7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[912] ntdll.dll!NtLoadDriver + 4                                                                      7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[912] ntdll.dll!NtSuspendProcess                                                                      7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[912] ntdll.dll!NtSuspendProcess + 4                                                                  7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateFileA                                                                        7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!VirtualProtect                                                                     7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!LoadLibraryExW                                                                     7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!LoadLibraryA                                                                       7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!TerminateProcess                                                                   7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!WriteProcessMemory                                                                 7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateProcessW                                                                     7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateProcessA                                                                     7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!LoadResource                                                                       7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!GetProcAddress                                                                     7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!LoadLibraryW                                                                       7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateRemoteThread                                                                 7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateRemoteThread + 4                                                             7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateThread                                                                       7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateFileW                                                                        7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!TerminateThread                                                                    7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!GetVolumeInformationA                                                              7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!DebugActiveProcess                                                                 7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!WinExec                                                                            7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] kernel32.dll!CreateToolhelp32Snapshot                                                           7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] ADVAPI32.dll!RegOpenKeyExA                                                                      77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] ADVAPI32.dll!RegCreateKeyExA                                                                    77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] ADVAPI32.dll!RegSetValueExA                                                                     77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] ADVAPI32.dll!OpenSCManagerA                                                                     77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[912] ADVAPI32.dll!OpenSCManagerA + 4                                                                 77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\svchost.exe[912] ADVAPI32.dll!LsaRemoveAccountRights                                                             77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] ADVAPI32.dll!CreateServiceA                                                                     77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!SetWindowsHookExW                                                                    7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!GetKeyState                                                                          7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!GetAsyncKeyState                                                                     7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!ShowWindow                                                                           7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!ShowWindow + 4                                                                       7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!SetWindowsHookExA                                                                    7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!SetWinEventHook                                                                      7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!GetWindowTextA                                                                       7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!DdeConnect                                                                           7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!EndTask                                                                              7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!RegisterRawInputDevices                                                              7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[912] USER32.dll!RegisterRawInputDevices + 4                                                          7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[912] SHELL32.dll!ShellExecuteExW                                                                     7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] SHELL32.dll!ShellExecuteEx                                                                      7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] SHELL32.dll!ShellExecuteA                                                                       7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\svchost.exe[912] SHELL32.dll!ShellExecuteW                                                                       7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[928] kernel32.dll!FreeLibrary + 15                                            7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ntdll.dll!NtLoadDriver                                                     7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ntdll.dll!NtLoadDriver + 4                                                 7C90D472 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ntdll.dll!NtSuspendProcess                                                 7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ntdll.dll!NtSuspendProcess + 4                                             7C90DE32 2 Bytes  [3B, 5F]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateFileA                                                   7C801A28 6 Bytes  JMP 5F6A0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!VirtualProtect                                                7C801AD4 6 Bytes  JMP 5F730F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!LoadLibraryExW                                                7C801AF5 6 Bytes  JMP 5F160F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!LoadLibraryExW + C4                                           7C801BB9 4 Bytes  CALL 003F0001 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!LoadLibraryA                                                  7C801D7B 6 Bytes  JMP 5F220F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!TerminateProcess                                              7C801E1A 6 Bytes  JMP 5F1C0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!WriteProcessMemory                                            7C802213 6 Bytes  JMP 5F1F0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateProcessW                                                7C802336 6 Bytes  JMP 5F310F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateProcessA                                                7C80236B 6 Bytes  JMP 5F2E0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!LoadResource                                                  7C80A055 6 Bytes  JMP 5F7F0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!FreeLibrary + 15                                              7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!GetProcAddress                                                7C80AE40 6 Bytes  JMP 5F580F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!LoadLibraryW                                                  7C80AEEB 6 Bytes  JMP 5F250F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateRemoteThread                                            7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateRemoteThread + 4                                        7C8104D0 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateThread                                                  7C8106D7 6 Bytes  JMP 5F700F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateFileW                                                   7C810800 6 Bytes  JMP 5F670F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!TerminateThread                                               7C81CB3B 6 Bytes  JMP 5F3D0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!GetVolumeInformationA                                         7C821BA5 6 Bytes  JMP 5F5B0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!DebugActiveProcess                                            7C85B0FB 6 Bytes  JMP 5F400F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!WinExec                                                       7C86250D 6 Bytes  JMP 5F340F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] kernel32.dll!CreateToolhelp32Snapshot                                      7C865C7F 6 Bytes  JMP 5F6D0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ADVAPI32.dll!RegOpenKeyExA                                                 77DD7852 6 Bytes  JMP 5F610F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ADVAPI32.dll!RegCreateKeyExA                                               77DDE9F4 6 Bytes  JMP 5F5E0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ADVAPI32.dll!RegSetValueExA                                                77DDEAE7 6 Bytes  JMP 5F640F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ADVAPI32.dll!OpenSCManagerA                                                77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ADVAPI32.dll!OpenSCManagerA + 4                                            77DF69B2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ADVAPI32.dll!LsaRemoveAccountRights                                        77E1AC91 6 Bytes  JMP 5F190F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] ADVAPI32.dll!CreateServiceA                                                77E37211 6 Bytes  JMP 5F4F0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!ChangeDisplaySettingsExA                                        7E42384E 6 Bytes  JMP 5F0D0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!SetForegroundWindow                                             7E4242ED 6 Bytes  JMP 5F040F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!SetWindowsHookExW                                               7E42820F 6 Bytes  JMP 5F2B0F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!SetWindowPos                                                    7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!SetWindowPos + 4                                                7E4299F7 2 Bytes  [0B, 5F]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!GetKeyState                                                     7E429ED9 6 Bytes  JMP 5F430F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!GetAsyncKeyState                                                7E42A78F 6 Bytes  JMP 5F460F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!ShowWindow                                                      7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!ShowWindow + 4                                                  7E42AF5A 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!SetWindowsHookExA                                               7E431211 6 Bytes  JMP 5F280F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!SetWinEventHook                                                 7E4317F7 6 Bytes  JMP 5F520F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!GetWindowTextA                                                  7E43216B 6 Bytes  JMP 5F790F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!DdeConnect                                                      7E4581C3 6 Bytes  JMP 5F490F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!ChangeDisplaySettingsExW                                        7E4595BD 6 Bytes  JMP 5F100F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!EndTask                                                         7E45A0A5 6 Bytes  JMP 5F370F5A 
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!RegisterRawInputDevices                                         7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\DOCUME~1\CATHER~1\LOCALS~1\Temp\cczipwiz\gmer.exe[956] USER32.dll!RegisterRawInputDevices + 4                                     7E46CE12 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!CreateFileA                                                                      7C801A28 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!VirtualProtect                                                                   7C801AD4 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!LoadLibraryExW                                                                   7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!LoadResource                                                                     7C80A055 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!GetProcAddress                                                                   7C80AE40 6 Bytes  JMP 5F040F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!CreateThread                                                                     7C8106D7 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!CreateFileW                                                                      7C810800 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!GetVolumeInformationA                                                            7C821BA5 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] kernel32.dll!CreateToolhelp32Snapshot                                                         7C865C7F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] ADVAPI32.dll!RegOpenKeyExA                                                                    77DD7852 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] ADVAPI32.dll!RegCreateKeyExA                                                                  77DDE9F4 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] ADVAPI32.dll!RegSetValueExA                                                                   77DDEAE7 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\winlogon.exe[1004] ADVAPI32.dll!OpenSCManagerA                                                                   77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[1004] ADVAPI32.dll!OpenSCManagerA + 4                                                               77DF69B2 2 Bytes  [26, 5F]
.text           C:\WINDOWS\system32\winlogon.exe[1004] USER32.dll!ShowWindow                                                                         7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\winlogon.exe[1004] USER32.dll!ShowWindow + 4                                                                     7E42AF5A 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\winlogon.exe[1004] USER32.dll!GetWindowTextA                                                                     7E43216B 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\services.exe[1048] ntdll.dll!NtLoadDriver                                                                        7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[1048] ntdll.dll!NtLoadDriver + 4                                                                    7C90D472 2 Bytes  [3E, 5F]
.text           C:\WINDOWS\system32\services.exe[1048] ntdll.dll!NtSuspendProcess                                                                    7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[1048] ntdll.dll!NtSuspendProcess + 4                                                                7C90DE32 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateFileA                                                                      7C801A28 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!VirtualProtect                                                                   7C801AD4 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!LoadLibraryExW                                                                   7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!LoadLibraryA                                                                     7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!TerminateProcess                                                                 7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!WriteProcessMemory                                                               7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateProcessW                                                                   7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateProcessA                                                                   7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!LoadResource                                                                     7C80A055 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!GetProcAddress                                                                   7C80AE40 6 Bytes  JMP 5F490F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!LoadLibraryW                                                                     7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateRemoteThread                                                               7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateRemoteThread + 4                                                           7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateThread                                                                     7C8106D7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateFileW                                                                      7C810800 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!TerminateThread                                                                  7C81CB3B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!GetVolumeInformationA                                                            7C821BA5 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!DebugActiveProcess                                                               7C85B0FB 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!WinExec                                                                          7C86250D 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\services.exe[1048] kernel32.dll!CreateToolhelp32Snapshot                                                         7C865C7F 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] ADVAPI32.dll!RegOpenKeyExA                                                                    77DD7852 6 Bytes  JMP 5F520F5A 
.text           C:\WINDOWS\system32\services.exe[1048] ADVAPI32.dll!RegCreateKeyExA                                                                  77DDE9F4 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] ADVAPI32.dll!RegSetValueExA                                                                   77DDEAE7 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\services.exe[1048] ADVAPI32.dll!OpenSCManagerA                                                                   77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[1048] ADVAPI32.dll!OpenSCManagerA + 4                                                               77DF69B2 2 Bytes  [68, 5F]
.text           C:\WINDOWS\system32\services.exe[1048] ADVAPI32.dll!LsaRemoveAccountRights                                                           77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] ADVAPI32.dll!CreateServiceA                                                                   77E37211 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!SetWindowsHookExW                                                                  7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!GetKeyState                                                                        7E429ED9 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!GetAsyncKeyState                                                                   7E42A78F 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!ShowWindow                                                                         7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!ShowWindow + 4                                                                     7E42AF5A 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!SetWindowsHookExA                                                                  7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!SetWinEventHook                                                                    7E4317F7 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!GetWindowTextA                                                                     7E43216B 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!DdeConnect                                                                         7E4581C3 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!EndTask                                                                            7E45A0A5 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!RegisterRawInputDevices                                                            7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\services.exe[1048] USER32.dll!RegisterRawInputDevices + 4                                                        7E46CE12 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\system32\lsass.exe[1060] ntdll.dll!NtLoadDriver                                                                           7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[1060] ntdll.dll!NtLoadDriver + 4                                                                       7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\lsass.exe[1060] ntdll.dll!NtSuspendProcess                                                                       7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[1060] ntdll.dll!NtSuspendProcess + 4                                                                   7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateFileA                                                                         7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!VirtualProtect                                                                      7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!LoadLibraryExW                                                                      7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!LoadLibraryA                                                                        7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!TerminateProcess                                                                    7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!WriteProcessMemory                                                                  7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateProcessW                                                                      7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateProcessA                                                                      7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!LoadResource                                                                        7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!GetProcAddress                                                                      7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!LoadLibraryW                                                                        7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateRemoteThread                                                                  7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateRemoteThread + 4                                                              7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateThread                                                                        7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateFileW                                                                         7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!TerminateThread                                                                     7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!GetVolumeInformationA                                                               7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!DebugActiveProcess                                                                  7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!WinExec                                                                             7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] kernel32.dll!CreateToolhelp32Snapshot                                                            7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] ADVAPI32.dll!RegOpenKeyExA                                                                       77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] ADVAPI32.dll!RegCreateKeyExA                                                                     77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] ADVAPI32.dll!RegSetValueExA                                                                      77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] ADVAPI32.dll!OpenSCManagerA                                                                      77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[1060] ADVAPI32.dll!OpenSCManagerA + 4                                                                  77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\lsass.exe[1060] ADVAPI32.dll!LsaRemoveAccountRights                                                              77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] ADVAPI32.dll!CreateServiceA                                                                      77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!SetWindowsHookExW                                                                     7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!GetKeyState                                                                           7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!GetAsyncKeyState                                                                      7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!ShowWindow                                                                            7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!ShowWindow + 4                                                                        7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!SetWindowsHookExA                                                                     7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!SetWinEventHook                                                                       7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!GetWindowTextA                                                                        7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!DdeConnect                                                                            7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!EndTask                                                                               7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!RegisterRawInputDevices                                                               7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\lsass.exe[1060] USER32.dll!RegisterRawInputDevices + 4                                                           7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\lsass.exe[1060] SHELL32.dll!ShellExecuteExW                                                                      7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] SHELL32.dll!ShellExecuteEx                                                                       7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] SHELL32.dll!ShellExecuteA                                                                        7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\lsass.exe[1060] SHELL32.dll!ShellExecuteW                                                                        7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtLoadDriver                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtLoadDriver + 4                                                                     7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtSuspendProcess                                                                     7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtSuspendProcess + 4                                                                 7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateFileA                                                                       7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!VirtualProtect                                                                    7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryA                                                                      7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!TerminateProcess                                                                  7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!WriteProcessMemory                                                                7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessW                                                                    7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessA                                                                    7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadResource                                                                      7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetProcAddress                                                                    7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateRemoteThread                                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateRemoteThread + 4                                                            7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateThread                                                                      7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateFileW                                                                       7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!TerminateThread                                                                   7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetVolumeInformationA                                                             7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!DebugActiveProcess                                                                7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!WinExec                                                                           7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateToolhelp32Snapshot                                                          7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegSetValueExA                                                                    77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!OpenSCManagerA                                                                    77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!OpenSCManagerA + 4                                                                77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!LsaRemoveAccountRights                                                            77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!CreateServiceA                                                                    77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!SetWindowsHookExW                                                                   7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!GetKeyState                                                                         7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!GetAsyncKeyState                                                                    7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!ShowWindow                                                                          7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!ShowWindow + 4                                                                      7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!SetWindowsHookExA                                                                   7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!SetWinEventHook                                                                     7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!GetWindowTextA                                                                      7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!DdeConnect                                                                          7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!EndTask                                                                             7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!RegisterRawInputDevices                                                             7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!RegisterRawInputDevices + 4                                                         7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1244] SHELL32.dll!ShellExecuteExW                                                                    7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] SHELL32.dll!ShellExecuteEx                                                                     7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] SHELL32.dll!ShellExecuteA                                                                      7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\svchost.exe[1244] SHELL32.dll!ShellExecuteW                                                                      7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtLoadDriver                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtLoadDriver + 4                                                                     7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtSuspendProcess                                                                     7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtSuspendProcess + 4                                                                 7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateFileA                                                                       7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!VirtualProtect                                                                    7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!LoadLibraryA                                                                      7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!TerminateProcess                                                                  7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!WriteProcessMemory                                                                7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessW                                                                    7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessA                                                                    7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!LoadResource                                                                      7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!GetProcAddress                                                                    7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateRemoteThread                                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateRemoteThread + 4                                                            7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateThread                                                                      7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateFileW                                                                       7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!TerminateThread                                                                   7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!GetVolumeInformationA                                                             7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!DebugActiveProcess                                                                7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!WinExec                                                                           7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateToolhelp32Snapshot                                                          7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!RegSetValueExA                                                                    77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!OpenSCManagerA                                                                    77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!OpenSCManagerA + 4                                                                77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!LsaRemoveAccountRights                                                            77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateServiceA                                                                    77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExW                                                                   7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!GetKeyState                                                                         7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!GetAsyncKeyState                                                                    7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!ShowWindow                                                                          7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!ShowWindow + 4                                                                      7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExA                                                                   7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWinEventHook                                                                     7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!GetWindowTextA                                                                      7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!DdeConnect                                                                          7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!EndTask                                                                             7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!RegisterRawInputDevices                                                             7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!RegisterRawInputDevices + 4                                                         7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1328] SHELL32.dll!ShellExecuteExW                                                                    7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] SHELL32.dll!ShellExecuteEx                                                                     7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] SHELL32.dll!ShellExecuteA                                                                      7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\svchost.exe[1328] SHELL32.dll!ShellExecuteW                                                                      7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] ntdll.dll!NtLoadDriver                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1440] ntdll.dll!NtLoadDriver + 4                                                                     7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[1440] ntdll.dll!NtSuspendProcess                                                                     7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1440] ntdll.dll!NtSuspendProcess + 4                                                                 7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateFileA                                                                       7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!VirtualProtect                                                                    7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!LoadLibraryA                                                                      7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!TerminateProcess                                                                  7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!WriteProcessMemory                                                                7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateProcessW                                                                    7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateProcessA                                                                    7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!LoadResource                                                                      7C80A055 6 Bytes  JMP 5F7E0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!GetProcAddress                                                                    7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateRemoteThread                                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateRemoteThread + 4                                                            7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateThread                                                                      7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateFileW                                                                       7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!TerminateThread                                                                   7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!GetVolumeInformationA                                                             7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!DebugActiveProcess                                                                7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!WinExec                                                                           7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateToolhelp32Snapshot                                                          7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!RegSetValueExA                                                                    77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!OpenSCManagerA                                                                    77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!OpenSCManagerA + 4                                                                77DF69B2 2 Bytes  [75, 5F] {JNZ 0x61}
.text           C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!LsaRemoveAccountRights                                                            77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!CreateServiceA                                                                    77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWindowsHookExW                                                                   7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!GetKeyState                                                                         7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!GetAsyncKeyState                                                                    7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!ShowWindow                                                                          7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!ShowWindow + 4                                                                      7E42AF5A 2 Bytes  [7C, 5F] {JL 0x61}
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWindowsHookExA                                                                   7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWinEventHook                                                                     7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!GetWindowTextA                                                                      7E43216B 6 Bytes  JMP 5F780F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!DdeConnect                                                                          7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!EndTask                                                                             7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!RegisterRawInputDevices                                                             7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!RegisterRawInputDevices + 4                                                         7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[1440] SHELL32.dll!ShellExecuteExW                                                                    7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] SHELL32.dll!ShellExecuteEx                                                                     7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] SHELL32.dll!ShellExecuteA                                                                      7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\System32\svchost.exe[1440] SHELL32.dll!ShellExecuteW                                                                      7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ntdll.dll!NtLoadDriver                                                                7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ntdll.dll!NtLoadDriver + 4                                                            7C90D472 2 Bytes  [4B, 5F] {DEC EBX; POP EDI}
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ntdll.dll!NtSuspendProcess                                                            7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ntdll.dll!NtSuspendProcess + 4                                                        7C90DE32 2 Bytes  [39, 5F]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateFileA                                                              7C801A28 6 Bytes  JMP 5F680F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!VirtualProtect                                                           7C801AD4 6 Bytes  JMP 5F710F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!LoadLibraryExW                                                           7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!LoadLibraryA                                                             7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!TerminateProcess                                                         7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!WriteProcessMemory                                                       7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateProcessW                                                           7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateProcessA                                                           7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!LoadResource                                                             7C80A055 6 Bytes  JMP 5F7D0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!GetProcAddress                                                           7C80AE40 6 Bytes  JMP 5F560F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!LoadLibraryW                                                             7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateRemoteThread                                                       7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateRemoteThread + 4                                                   7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateThread                                                             7C8106D7 6 Bytes  JMP 5F6E0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateFileW                                                              7C810800 6 Bytes  JMP 5F650F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!TerminateThread                                                          7C81CB3B 6 Bytes  JMP 5F3B0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!GetVolumeInformationA                                                    7C821BA5 6 Bytes  JMP 5F590F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!DebugActiveProcess                                                       7C85B0FB 6 Bytes  JMP 5F3E0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!WinExec                                                                  7C86250D 6 Bytes  JMP 5F320F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] kernel32.dll!CreateToolhelp32Snapshot                                                 7C865C7F 6 Bytes  JMP 5F6B0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ADVAPI32.dll!RegOpenKeyExA                                                            77DD7852 6 Bytes  JMP 5F5F0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ADVAPI32.dll!RegCreateKeyExA                                                          77DDE9F4 6 Bytes  JMP 5F5C0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ADVAPI32.dll!RegSetValueExA                                                           77DDEAE7 6 Bytes  JMP 5F620F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ADVAPI32.dll!OpenSCManagerA                                                           77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ADVAPI32.dll!OpenSCManagerA + 4                                                       77DF69B2 2 Bytes  [75, 5F] {JNZ 0x61}
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ADVAPI32.dll!LsaRemoveAccountRights                                                   77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] ADVAPI32.dll!CreateServiceA                                                           77E37211 6 Bytes  JMP 5F4D0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!SetWindowsHookExW                                                          7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!GetKeyState                                                                7E429ED9 6 Bytes  JMP 5F410F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!GetAsyncKeyState                                                           7E42A78F 6 Bytes  JMP 5F440F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!ShowWindow                                                                 7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!ShowWindow + 4                                                             7E42AF5A 2 Bytes  [7B, 5F] {JNP 0x61}
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!SetWindowsHookExA                                                          7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!SetWinEventHook                                                            7E4317F7 6 Bytes  JMP 5F500F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!GetWindowTextA                                                             7E43216B 6 Bytes  JMP 5F770F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!DdeConnect                                                                 7E4581C3 6 Bytes  JMP 5F470F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!EndTask                                                                    7E45A0A5 6 Bytes  JMP 5F350F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!RegisterRawInputDevices                                                    7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] USER32.dll!RegisterRawInputDevices + 4                                                7E46CE12 2 Bytes  [54, 5F] {PUSH ESP; POP EDI}
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] SHELL32.dll!ShellExecuteExW                                                           7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] SHELL32.dll!ShellExecuteEx                                                            7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] SHELL32.dll!ShellExecuteA                                                             7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\System32\inetsrv\inetinfo.exe[1468] SHELL32.dll!ShellExecuteW                                                             7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] ntdll.dll!NtLoadDriver                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1508] ntdll.dll!NtLoadDriver + 4                                                                     7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[1508] ntdll.dll!NtSuspendProcess                                                                     7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1508] ntdll.dll!NtSuspendProcess + 4                                                                 7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateFileA                                                                       7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!VirtualProtect                                                                    7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!LoadLibraryA                                                                      7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!TerminateProcess                                                                  7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!WriteProcessMemory                                                                7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateProcessW                                                                    7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateProcessA                                                                    7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!LoadResource                                                                      7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!GetProcAddress                                                                    7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateRemoteThread                                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateRemoteThread + 4                                                            7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateThread                                                                      7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateFileW                                                                       7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!TerminateThread                                                                   7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!GetVolumeInformationA                                                             7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!DebugActiveProcess                                                                7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!WinExec                                                                           7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] kernel32.dll!CreateToolhelp32Snapshot                                                          7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] ADVAPI32.dll!RegSetValueExA                                                                    77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] ADVAPI32.dll!OpenSCManagerA                                                                    77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1508] ADVAPI32.dll!OpenSCManagerA + 4                                                                77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\System32\svchost.exe[1508] ADVAPI32.dll!LsaRemoveAccountRights                                                            77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] ADVAPI32.dll!CreateServiceA                                                                    77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!SetWindowsHookExW                                                                   7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!GetKeyState                                                                         7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!GetAsyncKeyState                                                                    7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!ShowWindow                                                                          7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!ShowWindow + 4                                                                      7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!SetWindowsHookExA                                                                   7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!SetWinEventHook                                                                     7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!GetWindowTextA                                                                      7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!DdeConnect                                                                          7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!EndTask                                                                             7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!RegisterRawInputDevices                                                             7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!RegisterRawInputDevices + 4                                                         7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\System32\svchost.exe[1508] SHELL32.dll!ShellExecuteExW                                                                    7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] SHELL32.dll!ShellExecuteEx                                                                     7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] SHELL32.dll!ShellExecuteA                                                                      7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\System32\svchost.exe[1508] SHELL32.dll!ShellExecuteW                                                                      7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ntdll.dll!NtLoadDriver                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ntdll.dll!NtLoadDriver + 4                                                     7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ntdll.dll!NtSuspendProcess                                                     7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ntdll.dll!NtSuspendProcess + 4                                                 7C90DE32 2 Bytes  [38, 5F]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateFileA                                                       7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!VirtualProtect                                                    7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!LoadLibraryExW                                                    7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!LoadLibraryA                                                      7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!TerminateProcess                                                  7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!WriteProcessMemory                                                7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateProcessW                                                    7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateProcessA                                                    7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!LoadResource                                                      7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!GetProcAddress                                                    7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!LoadLibraryW                                                      7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateRemoteThread                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateRemoteThread + 4                                            7C8104D0 2 Bytes  [05, 5F]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateThread                                                      7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateFileW                                                       7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!TerminateThread                                                   7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!GetVolumeInformationA                                             7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!DebugActiveProcess                                                7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!WinExec                                                           7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] kernel32.dll!CreateToolhelp32Snapshot                                          7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!SetWindowsHookExW                                                   7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!GetKeyState                                                         7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!GetAsyncKeyState                                                    7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!ShowWindow                                                          7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!ShowWindow + 4                                                      7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!SetWindowsHookExA                                                   7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!SetWinEventHook                                                     7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!GetWindowTextA                                                      7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!DdeConnect                                                          7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!EndTask                                                             7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!RegisterRawInputDevices                                             7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] USER32.dll!RegisterRawInputDevices + 4                                         7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ADVAPI32.dll!RegOpenKeyExA                                                     77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ADVAPI32.dll!RegCreateKeyExA                                                   77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ADVAPI32.dll!RegSetValueExA                                                    77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ADVAPI32.dll!OpenSCManagerA                                                    77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ADVAPI32.dll!OpenSCManagerA + 4                                                77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ADVAPI32.dll!LsaRemoveAccountRights                                            77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] ADVAPI32.dll!CreateServiceA                                                    77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] SHELL32.dll!ShellExecuteExW                                                    7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] SHELL32.dll!ShellExecuteEx                                                     7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] SHELL32.dll!ShellExecuteA                                                      7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Microsoft LifeCam\MSCamS32.exe[1576] SHELL32.dll!ShellExecuteW                                                      7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] ntdll.dll!NtLoadDriver                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1632] ntdll.dll!NtLoadDriver + 4                                                                     7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1632] ntdll.dll!NtSuspendProcess                                                                     7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1632] ntdll.dll!NtSuspendProcess + 4                                                                 7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateFileA                                                                       7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!VirtualProtect                                                                    7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!LoadLibraryA                                                                      7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!TerminateProcess                                                                  7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!WriteProcessMemory                                                                7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateProcessW                                                                    7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateProcessA                                                                    7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!LoadResource                                                                      7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!GetProcAddress                                                                    7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateRemoteThread                                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateRemoteThread + 4                                                            7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateThread                                                                      7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateFileW                                                                       7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!TerminateThread                                                                   7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!GetVolumeInformationA                                                             7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!DebugActiveProcess                                                                7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!WinExec                                                                           7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] kernel32.dll!CreateToolhelp32Snapshot                                                          7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] ADVAPI32.dll!RegSetValueExA                                                                    77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] ADVAPI32.dll!OpenSCManagerA                                                                    77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1632] ADVAPI32.dll!OpenSCManagerA + 4                                                                77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\svchost.exe[1632] ADVAPI32.dll!LsaRemoveAccountRights                                                            77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] ADVAPI32.dll!CreateServiceA                                                                    77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!SetWindowsHookExW                                                                   7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!GetKeyState                                                                         7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!GetAsyncKeyState                                                                    7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!ShowWindow                                                                          7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!ShowWindow + 4                                                                      7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!SetWindowsHookExA                                                                   7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!SetWinEventHook                                                                     7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!GetWindowTextA                                                                      7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!DdeConnect                                                                          7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!EndTask                                                                             7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!RegisterRawInputDevices                                                             7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\svchost.exe[1632] USER32.dll!RegisterRawInputDevices + 4                                                         7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\svchost.exe[1632] SHELL32.dll!ShellExecuteExW                                                                    7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] SHELL32.dll!ShellExecuteEx                                                                     7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] SHELL32.dll!ShellExecuteA                                                                      7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\svchost.exe[1632] SHELL32.dll!ShellExecuteW                                                                      7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ntdll.dll!NtLoadDriver                                                 7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ntdll.dll!NtLoadDriver + 4                                             7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ntdll.dll!NtSuspendProcess                                             7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ntdll.dll!NtSuspendProcess + 4                                         7C90DE32 2 Bytes  [38, 5F]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateFileA                                               7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!VirtualProtect                                            7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!LoadLibraryExW                                            7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!LoadLibraryA                                              7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!TerminateProcess                                          7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!WriteProcessMemory                                        7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateProcessW                                            7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateProcessA                                            7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!LoadResource                                              7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!GetProcAddress                                            7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!LoadLibraryW                                              7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateRemoteThread                                        7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateRemoteThread + 4                                    7C8104D0 2 Bytes  [05, 5F]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateThread                                              7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateFileW                                               7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!TerminateThread                                           7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!GetVolumeInformationA                                     7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!DebugActiveProcess                                        7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!WinExec                                                   7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] kernel32.dll!CreateToolhelp32Snapshot                                  7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!SetWindowsHookExW                                           7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!GetKeyState                                                 7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!GetAsyncKeyState                                            7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!ShowWindow                                                  7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!ShowWindow + 4                                              7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!SetWindowsHookExA                                           7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!SetWinEventHook                                             7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!GetWindowTextA                                              7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!DdeConnect                                                  7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!EndTask                                                     7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!RegisterRawInputDevices                                     7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] USER32.dll!RegisterRawInputDevices + 4                                 7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ADVAPI32.dll!RegOpenKeyExA                                             77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ADVAPI32.dll!RegCreateKeyExA                                           77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ADVAPI32.dll!RegSetValueExA                                            77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ADVAPI32.dll!OpenSCManagerA                                            77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ADVAPI32.dll!OpenSCManagerA + 4                                        77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ADVAPI32.dll!LsaRemoveAccountRights                                    77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] ADVAPI32.dll!CreateServiceA                                            77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] SHELL32.dll!ShellExecuteExW                                            7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] SHELL32.dll!ShellExecuteEx                                             7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] SHELL32.dll!ShellExecuteA                                              7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe[1788] SHELL32.dll!ShellExecuteW                                              7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] ntdll.dll!NtLoadDriver                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\notepad.exe[1840] ntdll.dll!NtLoadDriver + 4                                                                     7C90D472 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\WINDOWS\system32\notepad.exe[1840] ntdll.dll!NtSuspendProcess                                                                     7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\notepad.exe[1840] ntdll.dll!NtSuspendProcess + 4                                                                 7C90DE32 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateFileA                                                                       7C801A28 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!VirtualProtect                                                                    7C801AD4 6 Bytes  JMP 5F7F0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!LoadLibraryExW + C4                                                               7C801BB9 4 Bytes  CALL 00AF0001 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!LoadLibraryA                                                                      7C801D7B 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!TerminateProcess                                                                  7C801E1A 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!WriteProcessMemory                                                                7C802213 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateProcessW                                                                    7C802336 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateProcessA                                                                    7C80236B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!LoadResource                                                                      7C80A055 6 Bytes  JMP 5F8B0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!FreeLibrary + 15                                                                  7C80AC93 4 Bytes  CALL 7170003D 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!GetProcAddress                                                                    7C80AE40 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateRemoteThread                                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateRemoteThread + 4                                                            7C8104D0 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateThread                                                                      7C8106D7 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateFileW                                                                       7C810800 6 Bytes  JMP 5F730F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!TerminateThread                                                                   7C81CB3B 6 Bytes  JMP 5F490F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!GetVolumeInformationA                                                             7C821BA5 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!DebugActiveProcess                                                                7C85B0FB 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!WinExec                                                                           7C86250D 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] kernel32.dll!CreateToolhelp32Snapshot                                                          7C865C7F 6 Bytes  JMP 5F790F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] ADVAPI32.dll!RegSetValueExA                                                                    77DDEAE7 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] ADVAPI32.dll!OpenSCManagerA                                                                    77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\notepad.exe[1840] ADVAPI32.dll!OpenSCManagerA + 4                                                                77DF69B2 2 Bytes  [83, 5F]
.text           C:\WINDOWS\system32\notepad.exe[1840] ADVAPI32.dll!LsaRemoveAccountRights                                                            77E1AC91 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] ADVAPI32.dll!CreateServiceA                                                                    77E37211 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!ChangeDisplaySettingsExA                                                            7E42384E 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!SetForegroundWindow                                                                 7E4242ED 6 Bytes  JMP 5F040F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!SetWindowsHookExW                                                                   7E42820F 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!SetWindowPos                                                                        7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!SetWindowPos + 4                                                                    7E4299F7 2 Bytes  [0B, 5F]
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!GetKeyState                                                                         7E429ED9 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!GetAsyncKeyState                                                                    7E42A78F 6 Bytes  JMP 5F520F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!ShowWindow                                                                          7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!ShowWindow + 4                                                                      7E42AF5A 2 Bytes  [89, 5F]
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!SetWindowsHookExA                                                                   7E431211 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!SetWinEventHook                                                                     7E4317F7 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!GetWindowTextA                                                                      7E43216B 6 Bytes  JMP 5F850F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!DdeConnect                                                                          7E4581C3 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!ChangeDisplaySettingsExW                                                            7E4595BD 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!EndTask                                                                             7E45A0A5 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!RegisterRawInputDevices                                                             7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\notepad.exe[1840] USER32.dll!RegisterRawInputDevices + 4                                                         7E46CE12 2 Bytes  [62, 5F]
.text           C:\WINDOWS\system32\notepad.exe[1840] SHELL32.dll!ShellExecuteExW                                                                    7CA0996B 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] SHELL32.dll!ShellExecuteEx                                                                     7CA40EB5 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] SHELL32.dll!ShellExecuteA                                                                      7CA411E0 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\notepad.exe[1840] SHELL32.dll!ShellExecuteW                                                                      7CAB5D48 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ntdll.dll!NtLoadDriver                                                                        7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ntdll.dll!NtLoadDriver + 4                                                                    7C90D472 2 Bytes  [3E, 5F]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ntdll.dll!NtSuspendProcess                                                                    7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ntdll.dll!NtSuspendProcess + 4                                                                7C90DE32 2 Bytes  [2C, 5F] {SUB AL, 0x5f}
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateFileA                                                                      7C801A28 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!VirtualProtect                                                                   7C801AD4 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!LoadLibraryExW                                                                   7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!LoadLibraryA                                                                     7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!TerminateProcess                                                                 7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!WriteProcessMemory                                                               7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateProcessW                                                                   7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateProcessA                                                                   7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!LoadResource                                                                     7C80A055 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!GetProcAddress                                                                   7C80AE40 6 Bytes  JMP 5F490F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!LoadLibraryW                                                                     7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateRemoteThread                                                               7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateRemoteThread + 4                                                           7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateThread                                                                     7C8106D7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateFileW                                                                      7C810800 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!TerminateThread                                                                  7C81CB3B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!GetVolumeInformationA                                                            7C821BA5 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!DebugActiveProcess                                                               7C85B0FB 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!WinExec                                                                          7C86250D 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] kernel32.dll!CreateToolhelp32Snapshot                                                         7C865C7F 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ADVAPI32.dll!RegOpenKeyExA                                                                    77DD7852 6 Bytes  JMP 5F520F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ADVAPI32.dll!RegCreateKeyExA                                                                  77DDE9F4 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ADVAPI32.dll!RegSetValueExA                                                                   77DDEAE7 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ADVAPI32.dll!OpenSCManagerA                                                                   77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ADVAPI32.dll!OpenSCManagerA + 4                                                               77DF69B2 2 Bytes  [68, 5F]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ADVAPI32.dll!LsaRemoveAccountRights                                                           77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] ADVAPI32.dll!CreateServiceA                                                                   77E37211 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!SetWindowsHookExW                                                                  7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!GetKeyState                                                                        7E429ED9 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!GetAsyncKeyState                                                                   7E42A78F 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!ShowWindow                                                                         7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!ShowWindow + 4                                                                     7E42AF5A 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!SetWindowsHookExA                                                                  7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!SetWinEventHook                                                                    7E4317F7 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!GetWindowTextA                                                                     7E43216B 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!DdeConnect                                                                         7E4581C3 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!EndTask                                                                            7E45A0A5 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!RegisterRawInputDevices                                                            7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\IoctlSvc.exe[1848] USER32.dll!RegisterRawInputDevices + 4                                                        7E46CE12 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\system32\PSIService.exe[1868] ntdll.dll!NtLoadDriver                                                                      7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\PSIService.exe[1868] ntdll.dll!NtLoadDriver + 4                                                                  7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\PSIService.exe[1868] ntdll.dll!NtSuspendProcess                                                                  7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\PSIService.exe[1868] ntdll.dll!NtSuspendProcess + 4                                                              7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateFileA                                                                    7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!VirtualProtect                                                                 7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!LoadLibraryExW                                                                 7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!LoadLibraryA                                                                   7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!TerminateProcess                                                               7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!WriteProcessMemory                                                             7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateProcessW                                                                 7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateProcessA                                                                 7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!LoadResource                                                                   7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!GetProcAddress                                                                 7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!LoadLibraryW                                                                   7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateRemoteThread                                                             7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateRemoteThread + 4                                                         7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateThread                                                                   7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateFileW                                                                    7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!TerminateThread                                                                7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!GetVolumeInformationA                                                          7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!DebugActiveProcess                                                             7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!WinExec                                                                        7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] kernel32.dll!CreateToolhelp32Snapshot                                                       7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] ADVAPI32.dll!RegOpenKeyExA                                                                  77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] ADVAPI32.dll!RegCreateKeyExA                                                                77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] ADVAPI32.dll!RegSetValueExA                                                                 77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] ADVAPI32.dll!OpenSCManagerA                                                                 77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\PSIService.exe[1868] ADVAPI32.dll!OpenSCManagerA + 4                                                             77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\PSIService.exe[1868] ADVAPI32.dll!LsaRemoveAccountRights                                                         77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] ADVAPI32.dll!CreateServiceA                                                                 77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!SetWindowsHookExW                                                                7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!GetKeyState                                                                      7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!GetAsyncKeyState                                                                 7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!ShowWindow                                                                       7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!ShowWindow + 4                                                                   7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!SetWindowsHookExA                                                                7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!SetWinEventHook                                                                  7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!GetWindowTextA                                                                   7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!DdeConnect                                                                       7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!EndTask                                                                          7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!RegisterRawInputDevices                                                          7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\PSIService.exe[1868] USER32.dll!RegisterRawInputDevices + 4                                                      7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\PSIService.exe[1868] SHELL32.dll!ShellExecuteExW                                                                 7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] SHELL32.dll!ShellExecuteEx                                                                  7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] SHELL32.dll!ShellExecuteA                                                                   7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\PSIService.exe[1868] SHELL32.dll!ShellExecuteW                                                                   7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ntdll.dll!NtLoadDriver                                            7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ntdll.dll!NtLoadDriver + 4                                        7C90D472 2 Bytes  [4B, 5F] {DEC EBX; POP EDI}
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ntdll.dll!NtSuspendProcess                                        7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ntdll.dll!NtSuspendProcess + 4                                    7C90DE32 2 Bytes  [39, 5F]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ntdll.dll!KiUserApcDispatcher                                     7C90E450 5 Bytes  JMP 00410E10 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateFileA                                          7C801A28 6 Bytes  JMP 5F680F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!VirtualProtect                                       7C801AD4 6 Bytes  JMP 5F710F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!LoadLibraryExW                                       7C801AF5 6 Bytes  JMP 716C000A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!LoadLibraryA                                         7C801D7B 6 Bytes  JMP 5F140F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!TerminateProcess                                     7C801E1A 6 Bytes  JMP 5F0E0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!WriteProcessMemory                                   7C802213 6 Bytes  JMP 5F110F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateProcessW                                       7C802336 6 Bytes  JMP 5F230F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateProcessA                                       7C80236B 6 Bytes  JMP 5F200F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!LoadResource                                         7C80A055 6 Bytes  JMP 5F7D0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!GetProcAddress                                       7C80AE40 6 Bytes  JMP 5F560F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!LoadLibraryW                                         7C80AEEB 6 Bytes  JMP 5F170F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateRemoteThread                                   7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateRemoteThread + 4                               7C8104D0 2 Bytes  [05, 5F]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateThread                                         7C8106D7 6 Bytes  JMP 5F6E0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateFileW                                          7C810800 6 Bytes  JMP 5F650F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!TerminateThread                                      7C81CB3B 6 Bytes  JMP 5F3B0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!GetVolumeInformationA                                7C821BA5 6 Bytes  JMP 5F590F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!DebugActiveProcess                                   7C85B0FB 6 Bytes  JMP 5F3E0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!WinExec                                              7C86250D 6 Bytes  JMP 5F320F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] kernel32.dll!CreateToolhelp32Snapshot                             7C865C7F 6 Bytes  JMP 5F6B0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!GetGUIThreadInfo + FB                                  7E428023 6 Bytes  JMP 00440C40 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!SetWindowsHookExW                                      7E42820F 6 Bytes  JMP 5F1D0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!GetKeyState                                            7E429ED9 6 Bytes  JMP 5F410F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!GetAsyncKeyState                                       7E42A78F 6 Bytes  JMP 5F440F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!ShowWindow                                             7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!ShowWindow + 4                                         7E42AF5A 2 Bytes  [7B, 5F] {JNP 0x61}
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!SetWindowsHookExA                                      7E431211 6 Bytes  JMP 5F1A0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!SetWinEventHook                                        7E4317F7 6 Bytes  JMP 5F500F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!GetWindowTextA                                         7E43216B 6 Bytes  JMP 5F770F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!DdeConnect                                             7E4581C3 6 Bytes  JMP 5F470F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!EndTask                                                7E45A0A5 6 Bytes  JMP 5F350F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!RegisterRawInputDevices                                7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] USER32.dll!RegisterRawInputDevices + 4                            7E46CE12 2 Bytes  [54, 5F] {PUSH ESP; POP EDI}
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ADVAPI32.dll!RegOpenKeyExA                                        77DD7852 6 Bytes  JMP 5F5F0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ADVAPI32.dll!RegCreateKeyExA                                      77DDE9F4 6 Bytes  JMP 5F5C0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ADVAPI32.dll!RegSetValueExA                                       77DDEAE7 6 Bytes  JMP 5F620F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ADVAPI32.dll!OpenSCManagerA                                       77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ADVAPI32.dll!OpenSCManagerA + 4                                   77DF69B2 2 Bytes  [75, 5F] {JNZ 0x61}
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ADVAPI32.dll!LsaRemoveAccountRights                               77E1AC91 6 Bytes  JMP 5F0B0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] ADVAPI32.dll!CreateServiceA                                       77E37211 6 Bytes  JMP 5F4D0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] WS2_32.dll!getaddrinfo                                            71AB2A6F 5 Bytes  JMP 71650022 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] WS2_32.dll!gethostbyname                                          71AB5355 5 Bytes  JMP 71680022 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] SHELL32.dll!ShellExecuteExW                                       7CA0996B 6 Bytes  JMP 5F2F0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] SHELL32.dll!ShellExecuteEx                                        7CA40EB5 6 Bytes  JMP 5F2C0F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] SHELL32.dll!ShellExecuteA                                         7CA411E0 6 Bytes  JMP 5F260F5A 
.text           C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] SHELL32.dll!ShellExecuteW                                         7CAB5D48 6 Bytes  JMP 5F290F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ntdll.dll!NtLoadDriver                                                                   7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ntdll.dll!NtLoadDriver + 4                                                               7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ntdll.dll!NtSuspendProcess                                                               7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ntdll.dll!NtSuspendProcess + 4                                                           7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateFileA                                                                 7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!VirtualProtect                                                              7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!LoadLibraryExW                                                              7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!LoadLibraryA                                                                7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!TerminateProcess                                                            7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!WriteProcessMemory                                                          7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateProcessW                                                              7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateProcessA                                                              7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!LoadResource                                                                7C80A055 6 Bytes  JMP 5F7C0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!GetProcAddress                                                              7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!LoadLibraryW                                                                7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateRemoteThread                                                          7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateRemoteThread + 4                                                      7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateThread                                                                7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateFileW                                                                 7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!WriteFile                                                                   7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!TerminateThread                                                             7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!GetVolumeInformationA                                                       7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!DebugActiveProcess                                                          7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!WinExec                                                                     7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] kernel32.dll!CreateToolhelp32Snapshot                                                    7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ADVAPI32.dll!RegOpenKeyExA                                                               77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ADVAPI32.dll!RegCreateKeyExA                                                             77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ADVAPI32.dll!RegSetValueExA                                                              77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ADVAPI32.dll!OpenSCManagerA                                                              77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ADVAPI32.dll!OpenSCManagerA + 4                                                          77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ADVAPI32.dll!LsaRemoveAccountRights                                                      77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] ADVAPI32.dll!CreateServiceA                                                              77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!SetWindowsHookExW                                                             7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!GetKeyState                                                                   7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!GetAsyncKeyState                                                              7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!ShowWindow                                                                    7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!ShowWindow + 4                                                                7E42AF5A 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!SetWindowsHookExA                                                             7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!SetWinEventHook                                                               7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!GetWindowTextA                                                                7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!DdeConnect                                                                    7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!EndTask                                                                       7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!RegisterRawInputDevices                                                       7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] USER32.dll!RegisterRawInputDevices + 4                                                   7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] SHELL32.dll!ShellExecuteExW                                                              7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] SHELL32.dll!ShellExecuteEx                                                               7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] SHELL32.dll!ShellExecuteA                                                                7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\SearchIndexer.exe[2096] SHELL32.dll!ShellExecuteW                                                                7CAB5D48 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ntdll.dll!NtLoadDriver                                               7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ntdll.dll!NtLoadDriver + 4                                           7C90D472 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ntdll.dll!NtSuspendProcess                                           7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ntdll.dll!NtSuspendProcess + 4                                       7C90DE32 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateFileA                                             7C801A28 6 Bytes  JMP 5F760F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!VirtualProtect                                          7C801AD4 6 Bytes  JMP 5F7F0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!LoadLibraryExW                                          7C801AF5 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!LoadLibraryExW + C4                                     7C801BB9 4 Bytes  CALL 02920001 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!LoadLibraryA                                            7C801D7B 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!TerminateProcess                                        7C801E1A 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!WriteProcessMemory                                      7C802213 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateProcessW                                          7C802336 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateProcessA                                          7C80236B 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!LoadResource                                            7C80A055 6 Bytes  JMP 5F8B0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!GetProcAddress                                          7C80AE40 6 Bytes  JMP 5F640F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!LoadLibraryW                                            7C80AEEB 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateRemoteThread                                      7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateRemoteThread + 4                                  7C8104D0 2 Bytes  [14, 5F] {ADC AL, 0x5f}
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateThread                                            7C8106D7 6 Bytes  JMP 5F7C0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateFileW                                             7C810800 6 Bytes  JMP 5F730F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!TerminateThread                                         7C81CB3B 6 Bytes  JMP 5F490F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!GetVolumeInformationA                                   7C821BA5 6 Bytes  JMP 5F670F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!DebugActiveProcess                                      7C85B0FB 6 Bytes  JMP 5F4C0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!WinExec                                                 7C86250D 6 Bytes  JMP 5F400F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] kernel32.dll!CreateToolhelp32Snapshot                                7C865C7F 6 Bytes  JMP 5F790F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!ChangeDisplaySettingsExA                                  7E42384E 6 Bytes  JMP 5F0D0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!SetForegroundWindow                                       7E4242ED 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!SetWindowsHookExW                                         7E42820F 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!SetWindowPos                                              7E4299F3 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!SetWindowPos + 4                                          7E4299F7 2 Bytes  [0B, 5F]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!GetKeyState                                               7E429ED9 6 Bytes  JMP 5F4F0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!GetAsyncKeyState                                          7E42A78F 6 Bytes  JMP 5F520F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!ShowWindow                                                7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!ShowWindow + 4                                            7E42AF5A 2 Bytes  [89, 5F]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!SetWindowsHookExA                                         7E431211 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!SetWinEventHook                                           7E4317F7 6 Bytes  JMP 5F5E0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!GetWindowTextA                                            7E43216B 6 Bytes  JMP 5F850F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!DdeConnect                                                7E4581C3 6 Bytes  JMP 5F550F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!ChangeDisplaySettingsExW                                  7E4595BD 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!EndTask                                                   7E45A0A5 6 Bytes  JMP 5F430F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!RegisterRawInputDevices                                   7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] USER32.dll!RegisterRawInputDevices + 4                               7E46CE12 2 Bytes  [62, 5F]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ADVAPI32.dll!RegOpenKeyExA                                           77DD7852 6 Bytes  JMP 5F6D0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ADVAPI32.dll!RegCreateKeyExA                                         77DDE9F4 6 Bytes  JMP 5F6A0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ADVAPI32.dll!RegSetValueExA                                          77DDEAE7 6 Bytes  JMP 5F700F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ADVAPI32.dll!OpenSCManagerA                                          77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ADVAPI32.dll!OpenSCManagerA + 4                                      77DF69B2 2 Bytes  [83, 5F]
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ADVAPI32.dll!LsaRemoveAccountRights                                  77E1AC91 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] ADVAPI32.dll!CreateServiceA                                          77E37211 6 Bytes  JMP 5F5B0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] SHELL32.dll!ShellExecuteExW                                          7CA0996B 6 Bytes  JMP 5F3D0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] SHELL32.dll!ShellExecuteEx                                           7CA40EB5 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] SHELL32.dll!ShellExecuteA                                            7CA411E0 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE[2604] SHELL32.dll!ShellExecuteW                                            7CAB5D48 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ntdll.dll!NtLoadDriver                                                                   7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ntdll.dll!NtLoadDriver + 4                                                               7C90D472 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ntdll.dll!NtSuspendProcess                                                               7C90DE2E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ntdll.dll!NtSuspendProcess + 4                                                           7C90DE32 2 Bytes  [38, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateFileA                                                                 7C801A28 6 Bytes  JMP 5F670F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!VirtualProtect                                                              7C801AD4 6 Bytes  JMP 5F700F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!LoadLibraryExW                                                              7C801AF5 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!LoadLibraryA                                                                7C801D7B 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!TerminateProcess                                                            7C801E1A 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!WriteProcessMemory                                                          7C802213 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateProcessW                                                              7C802336 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateProcessA                                                              7C80236B 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!LoadResource                                                                7C80A055 6 Bytes  JMP 5F7D0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!GetProcAddress                                                              7C80AE40 6 Bytes  JMP 5F550F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!LoadLibraryW                                                                7C80AEEB 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateRemoteThread                                                          7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateRemoteThread + 4                                                      7C8104D0 2 Bytes  [05, 5F]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateThread                                                                7C8106D7 6 Bytes  JMP 5F6D0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateFileW                                                                 7C810800 6 Bytes  JMP 5F640F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!TerminateThread                                                             7C81CB3B 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!GetVolumeInformationA                                                       7C821BA5 6 Bytes  JMP 5F580F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!DebugActiveProcess                                                          7C85B0FB 6 Bytes  JMP 5F3D0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!WinExec                                                                     7C86250D 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] kernel32.dll!CreateToolhelp32Snapshot                                                    7C865C7F 6 Bytes  JMP 5F6A0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ADVAPI32.dll!RegOpenKeyExA                                                               77DD7852 6 Bytes  JMP 5F5E0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ADVAPI32.dll!RegCreateKeyExA                                                             77DDE9F4 6 Bytes  JMP 5F5B0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ADVAPI32.dll!RegSetValueExA                                                              77DDEAE7 6 Bytes  JMP 5F610F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ADVAPI32.dll!OpenSCManagerA                                                              77DF69AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ADVAPI32.dll!OpenSCManagerA + 4                                                          77DF69B2 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ADVAPI32.dll!LsaRemoveAccountRights                                                      77E1AC91 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] ADVAPI32.dll!CreateServiceA                                                              77E37211 6 Bytes  JMP 5F4C0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!SetWindowsHookExW                                                             7E42820F 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!GetKeyState                                                                   7E429ED9 6 Bytes  JMP 5F400F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!GetAsyncKeyState                                                              7E42A78F 6 Bytes  JMP 5F430F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!ShowWindow                                                                    7E42AF56 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!ShowWindow + 4                                                                7E42AF5A 2 Bytes  [7B, 5F] {JNP 0x61}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!SetWindowsHookExA                                                             7E431211 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!SetWinEventHook                                                               7E4317F7 6 Bytes  JMP 5F4F0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!GetWindowTextA                                                                7E43216B 6 Bytes  JMP 5F760F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!DdeConnect                                                                    7E4581C3 6 Bytes  JMP 5F460F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!EndTask                                                                       7E45A0A5 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!RegisterRawInputDevices                                                       7E46CE0E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] USER32.dll!RegisterRawInputDevices + 4                                                   7E46CE12 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] SHELL32.dll!ShellExecuteExW                                                              7CA0996B 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] SHELL32.dll!ShellExecuteEx                                                               7CA40EB5 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] SHELL32.dll!ShellExecuteA                                                                7CA411E0 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3464] SHELL32.dll!ShellExecuteW                                                                7CAB5D48 6 Bytes  JMP 5F280F5A 

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]    5F080000
IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]     5F080000
IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]     5F080000
IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]  5F080000
IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]   5F080000
IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW]   5F080000
IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]   5F080000
IAT             C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[2028] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]   5F080000

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                               TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                             pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                            pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                            pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                          pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                             fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout                                                   15
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota                                                      10000
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                                                                    yes
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                                                                   
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout                                                   90
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota                                                     10000

---- EOF - GMER 1.0.15 ----