GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-05-18 13:52:13 Windows 5.1.2600 Service Pack 3 Running: oxf7d8ux.exe; Driver: C:\DOCUME~1\NICOLA~1\LOCALS~1\Temp\pxtdqpow.sys ---- System - GMER 1.0.15 ---- SSDT spkp.sys ZwCreateKey [0xF74E40E0] SSDT spkp.sys ZwEnumerateKey [0xF74FCDA4] SSDT spkp.sys ZwEnumerateValueKey [0xF74FD132] SSDT spkp.sys ZwOpenKey [0xF74E40C0] SSDT spkp.sys ZwQueryKey [0xF74FD20A] SSDT spkp.sys ZwQueryValueKey [0xF74FD08A] INT 0x62 ? 898B6BF8 INT 0x63 ? 892F4F00 INT 0x82 ? 898B6BF8 INT 0x83 ? 89849BF8 Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateFile [0xF7B077BE] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateProcess [0xF7B07610] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF7B07624] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteKey [0xF7B07690] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF7B076BC] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwLoadKey2 [0xF7B07740] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF7B077FE] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF7B0776C] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenProcess [0xF7B075D4] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenThread [0xF7B075E8] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF7B077D2] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF7B076FE] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwRenameKey [0xF7B076A6] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwReplaceKey [0xF7B07794] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwRestoreKey [0xF7B07780] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetContextThread [0xF7B0764E] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF7B0763A] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetValueKey [0xF7B076D2] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF7B0782D] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnloadKey [0xF7B07756] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF7B07814] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0xF7B077E8] Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtCreateFile Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenProcess Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenThread Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtSetInformationProcess ---- Kernel code sections - GMER 1.0.15 ---- .text ntoskrnl.exe!_abnormal_termination + 169 804DB7C5 3 Bytes [CD, 4F, F7] .text ntoskrnl.exe!ZwYieldExecution 804E9EA6 7 Bytes JMP F7B077EC mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtCreateFile 80568600 5 Bytes JMP F7B077C2 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtSetInformationProcess 80569441 5 Bytes JMP F7B0763E mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtOpenProcess 8056D1D0 5 Bytes JMP F7B075D8 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwProtectVirtualMemory 8056D57F 7 Bytes JMP F7B077D6 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwUnmapViewOfSection 80571606 5 Bytes JMP F7B07818 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtMapViewOfSection 80571A81 7 Bytes JMP F7B07802 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwSetValueKey 80572A43 7 Bytes JMP F7B076D6 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwCreateProcessEx 8057A030 7 Bytes JMP F7B07628 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwTerminateProcess 8057C6B0 5 Bytes JMP F7B07831 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtOpenThread 8058458D 5 Bytes JMP F7B075EC mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwNotifyChangeKey 80584A5D 5 Bytes JMP F7B07770 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwDeleteValueKey 8058BD50 7 Bytes JMP F7B076C0 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwDeleteKey 8058E2BE 7 Bytes JMP F7B07694 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwLoadKey2 805A7BAA 7 Bytes JMP F7B07744 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwCreateProcess 805AA36A 5 Bytes JMP F7B07614 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwSetContextThread 80626D47 5 Bytes JMP F7B07652 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwUnloadKey 80646A6E 7 Bytes JMP F7B0775A mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwQueryMultipleValueKey 80647394 7 Bytes JMP F7B07702 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwRenameKey 80647812 7 Bytes JMP F7B076AA mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwRestoreKey 80647D05 5 Bytes JMP F7B07784 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwReplaceKey 8064816E 5 Bytes JMP F7B07798 mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ? spkp.sys The system cannot find the file specified. ! .text C:\WINDOWS\system32\drivers\ykdktedr.sys section is writeable [0xF7648000, 0x2F40, 0xEC000040] .reloc C:\WINDOWS\system32\drivers\ykdktedr.sys section is executable [0xF764EE60, 0x1E60, 0xEE000040] ? C:\WINDOWS\system32\drivers\ykdktedr.sys Access is denied. .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xBA2E8380, 0x21F1AD, 0xE8000020] .text USBPORT.SYS!DllUnload BA2C88AC 5 Bytes JMP 892F44E0 ? System32\Drivers\adzjxui4.SYS The system cannot find the path specified. ! ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B9000A .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B90F97 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B90FB2 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B90FC3 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B90076 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B90040 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B900B3 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B90F6B .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B90F46 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B900DF .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00B90F21 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00B90065 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00B90FEF .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00B90F7C .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00B90FD4 .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00B9001B .text C:\WINDOWS\System32\svchost.exe[348] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00B900CE .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00930FDB .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0093006C .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0093002C .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0093001B .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00930047 .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00930000 .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00930FAF .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [B3, 88] {MOV BL, 0x88} .text C:\WINDOWS\System32\svchost.exe[348] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00930FC0 .text C:\WINDOWS\System32\svchost.exe[348] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00920FDE .text C:\WINDOWS\System32\svchost.exe[348] msvcrt.dll!system 77C293C7 5 Bytes JMP 00920FEF .text C:\WINDOWS\System32\svchost.exe[348] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00920044 .text C:\WINDOWS\System32\svchost.exe[348] msvcrt.dll!_open 77C2F566 5 Bytes JMP 0092000C .text C:\WINDOWS\System32\svchost.exe[348] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00920055 .text C:\WINDOWS\System32\svchost.exe[348] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0092001D .text C:\WINDOWS\System32\svchost.exe[348] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 0090000A .text C:\WINDOWS\System32\svchost.exe[348] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 0090001B .text C:\WINDOWS\System32\svchost.exe[348] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 00900036 .text C:\WINDOWS\System32\svchost.exe[348] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 00900FE5 .text C:\WINDOWS\System32\svchost.exe[348] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00910FEF ? C:\WINDOWS\services.exe[484] number of sections mismatch; unknown module: dnsapi.dll .text C:\WINDOWS\services.exe[484] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BE0000 .text C:\WINDOWS\services.exe[484] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BE0F6D .text C:\WINDOWS\services.exe[484] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BE006C .text C:\WINDOWS\services.exe[484] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BE0F92 .text C:\WINDOWS\services.exe[484] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BE0FB9 .text C:\WINDOWS\services.exe[484] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BE0FD4 .text C:\WINDOWS\services.exe[484] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BE00A4 .text C:\WINDOWS\services.exe[484] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BE0F5C .text C:\WINDOWS\services.exe[484] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BE0F1F .text C:\WINDOWS\services.exe[484] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BE0F30 .text C:\WINDOWS\services.exe[484] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BE0F0E .text C:\WINDOWS\services.exe[484] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BE0051 .text C:\WINDOWS\services.exe[484] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BE0FE5 .text C:\WINDOWS\services.exe[484] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BE007D .text C:\WINDOWS\services.exe[484] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BE0036 .text C:\WINDOWS\services.exe[484] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BE001B .text C:\WINDOWS\services.exe[484] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BE0F41 .text C:\WINDOWS\services.exe[484] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BC005B .text C:\WINDOWS\services.exe[484] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BC0FC6 .text C:\WINDOWS\services.exe[484] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BC0011 .text C:\WINDOWS\services.exe[484] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BC0000 .text C:\WINDOWS\services.exe[484] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BC002C .text C:\WINDOWS\services.exe[484] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BC0FE3 .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BD0025 .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BD0062 .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BD0FDE .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BD000A .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BD0FAF .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BD0FEF .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BD0051 .text C:\WINDOWS\services.exe[484] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BD0040 .text C:\WINDOWS\services.exe[484] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BB0FEF .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F7000A .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F70098 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F70FA3 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F7007D .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F70FC0 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F70FDB .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F70F88 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F700C4 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F70F59 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F700FC .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F7010D .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F70058 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F7001B .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F700B3 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F70047 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F70036 .text C:\WINDOWS\system32\services.exe[768] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F700E1 .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F6002C .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F60076 .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F6001B .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F6000A .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F60051 .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F60FEF .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F60FAF .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [16, 89] .text C:\WINDOWS\system32\services.exe[768] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F60FCA .text C:\WINDOWS\system32\services.exe[768] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F5003A .text C:\WINDOWS\system32\services.exe[768] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F50FAF .text C:\WINDOWS\system32\services.exe[768] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F50029 .text C:\WINDOWS\system32\services.exe[768] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F50000 .text C:\WINDOWS\system32\services.exe[768] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F50FD4 .text C:\WINDOWS\system32\services.exe[768] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F50FEF .text C:\WINDOWS\system32\services.exe[768] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F40000 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E80000 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E80F63 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E80F74 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E8004E .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E8003D .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E80FB6 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E8007F .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E80F37 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E80F1C .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E800AB .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00E80F0B .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00E80FA5 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00E80011 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00E80F48 .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00E80FDB .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00E8002C .text C:\WINDOWS\system32\lsass.exe[780] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00E80090 .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00E70FEF .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00E70FBC .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00E70040 .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00E7001B .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00E70FCD .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00E7000A .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00E70FDE .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [07, 89] .text C:\WINDOWS\system32\lsass.exe[780] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00E7005B .text C:\WINDOWS\system32\lsass.exe[780] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BF0064 .text C:\WINDOWS\system32\lsass.exe[780] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BF0FD9 .text C:\WINDOWS\system32\lsass.exe[780] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BF002E .text C:\WINDOWS\system32\lsass.exe[780] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BF0000 .text C:\WINDOWS\system32\lsass.exe[780] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BF0049 .text C:\WINDOWS\system32\lsass.exe[780] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BF001D .text C:\WINDOWS\system32\lsass.exe[780] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BE0000 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02450FEF .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02450F61 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02450F72 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0245004C .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02450F83 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02450025 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 024500A9 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0245008E .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02450F1A .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02450F2B .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 024500CE .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 02450F94 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 02450FDE .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 02450071 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02450014 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 02450FC3 .text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 02450F46 .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00FF0FCA .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00FF005B .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00FF001B .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00FF000A .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00FF004A .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00FF0FEF .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00FF0F9E .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [1F, 89] .text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00FF0FAF .text C:\WINDOWS\system32\svchost.exe[936] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FE008B .text C:\WINDOWS\system32\svchost.exe[936] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FE0070 .text C:\WINDOWS\system32\svchost.exe[936] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FE003A .text C:\WINDOWS\system32\svchost.exe[936] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FE000C .text C:\WINDOWS\system32\svchost.exe[936] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FE005F .text C:\WINDOWS\system32\svchost.exe[936] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FE0029 .text C:\WINDOWS\system32\svchost.exe[936] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FD0FEF .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00D20000 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00D20087 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00D20076 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D20065 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00D20FA8 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00D20040 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00D200A2 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00D20F66 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00D20F1A .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00D200B3 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00D20F09 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00D20FB9 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D20FEF .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00D20F81 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00D20FD4 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00D20025 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00D20F35 .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00D10047 .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00D10073 .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00D10036 .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00D1001B .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00D10FB6 .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00D10000 .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00D10062 .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00D10FDB .text C:\WINDOWS\system32\svchost.exe[996] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00D00FB7 .text C:\WINDOWS\system32\svchost.exe[996] msvcrt.dll!system 77C293C7 5 Bytes JMP 00D00FC8 .text C:\WINDOWS\system32\svchost.exe[996] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00D0002E .text C:\WINDOWS\system32\svchost.exe[996] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00D00000 .text C:\WINDOWS\system32\svchost.exe[996] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00D00FE3 .text C:\WINDOWS\system32\svchost.exe[996] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00D0001D .text C:\WINDOWS\system32\svchost.exe[996] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CF0000 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0228000A .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02280040 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02280F4B .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02280F72 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02280F8D .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02280FA8 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 02280F1A .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 02280062 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02280EDD .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02280EEE .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 02280091 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0228002F .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 02280FEF .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 02280051 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02280FB9 .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 02280FCA .text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 02280EFF .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0205001B .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 02050062 .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 02050FD4 .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0205000A .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 02050047 .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 02050FEF .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 02050036 .text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 02050FAF .text C:\WINDOWS\System32\svchost.exe[1092] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 02040FAD .text C:\WINDOWS\System32\svchost.exe[1092] msvcrt.dll!system 77C293C7 5 Bytes JMP 02040FC8 .text C:\WINDOWS\System32\svchost.exe[1092] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0204001D .text C:\WINDOWS\System32\svchost.exe[1092] msvcrt.dll!_open 77C2F566 5 Bytes JMP 02040000 .text C:\WINDOWS\System32\svchost.exe[1092] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 02040038 .text C:\WINDOWS\System32\svchost.exe[1092] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 02040FE3 .text C:\WINDOWS\System32\svchost.exe[1092] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02030FEF .text C:\WINDOWS\System32\svchost.exe[1092] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 02020000 .text C:\WINDOWS\System32\svchost.exe[1092] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 0202001B .text C:\WINDOWS\System32\svchost.exe[1092] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 02020FE5 .text C:\WINDOWS\System32\svchost.exe[1092] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 02020FD4 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0066000A .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0066008E .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0066007D .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00660F99 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00660062 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00660FD1 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 006600AB .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00660F63 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00660F37 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00660F48 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 006600E1 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00660FB6 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0066001B .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00660F7E .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00660047 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00660036 .text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 006600C6 .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00650000 .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00650F5E .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00650FAF .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00650FD4 .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00650F79 .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00650FE5 .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00650F8A .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [85, 88] .text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00650011 .text C:\WINDOWS\System32\svchost.exe[1180] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0064002C .text C:\WINDOWS\System32\svchost.exe[1180] msvcrt.dll!system 77C293C7 5 Bytes JMP 00640FA1 .text C:\WINDOWS\System32\svchost.exe[1180] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00640FBC .text C:\WINDOWS\System32\svchost.exe[1180] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00640000 .text C:\WINDOWS\System32\svchost.exe[1180] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00640011 .text C:\WINDOWS\System32\svchost.exe[1180] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00640FE3 .text C:\WINDOWS\System32\svchost.exe[1180] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00630FEF .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 009C0000 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 009C0089 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 009C0F9E .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009C0078 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 009C0FAF .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 009C0FDB .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 009C00D0 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 009C00BF .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009C0F6D .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 009C0106 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009C0121 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 009C0FC0 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 009C001B .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 009C00AE .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 009C0047 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 009C0036 .text C:\WINDOWS\System32\svchost.exe[1364] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 009C00EB .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009B0FB9 .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009B0F7C .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009B0014 .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009B0FDE .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 009B0039 .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 009B0FEF .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 009B0F97 .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [BB, 88] .text C:\WINDOWS\System32\svchost.exe[1364] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 009B0FA8 .text C:\WINDOWS\System32\svchost.exe[1364] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 009A0049 .text C:\WINDOWS\System32\svchost.exe[1364] msvcrt.dll!system 77C293C7 5 Bytes JMP 009A0FBE .text C:\WINDOWS\System32\svchost.exe[1364] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 009A001D .text C:\WINDOWS\System32\svchost.exe[1364] msvcrt.dll!_open 77C2F566 5 Bytes JMP 009A0000 .text C:\WINDOWS\System32\svchost.exe[1364] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 009A002E .text C:\WINDOWS\System32\svchost.exe[1364] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 009A0FE3 .text C:\WINDOWS\System32\svchost.exe[1364] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00990FEF .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001B0FEF .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001B0056 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001B0F61 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001B0F72 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001B002F .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001B0FA8 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001B009D .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001B0082 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001B0F29 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001B00B8 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001B0F18 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001B0F97 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001B0FD4 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001B0067 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001B0FB9 .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001B000A .text C:\WINDOWS\system32\wuauclt.exe[2276] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001B0F3A .text C:\WINDOWS\system32\wuauclt.exe[2276] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 002A0F95 .text C:\WINDOWS\system32\wuauclt.exe[2276] msvcrt.dll!system 77C293C7 5 Bytes JMP 002A0FA6 .text C:\WINDOWS\system32\wuauclt.exe[2276] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 002A0FD2 .text C:\WINDOWS\system32\wuauclt.exe[2276] msvcrt.dll!_open 77C2F566 5 Bytes JMP 002A0FEF .text C:\WINDOWS\system32\wuauclt.exe[2276] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 002A0FC1 .text C:\WINDOWS\system32\wuauclt.exe[2276] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 002A000C .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 002B0FB9 .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 002B0F72 .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 002B0FD4 .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 002B000A .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 002B002F .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 002B0FEF .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 002B0F8D .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [4B, 88] .text C:\WINDOWS\system32\wuauclt.exe[2276] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 002B0FA8 ? C:\WINDOWS\system32\svchost.exe[3184] image checksum mismatch; time/date stamp mismatch; unknown module: dbghelp.dll .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 066C0FEF .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 066C0056 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 066C0F57 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 066C0F72 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 066C002F .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 066C0F97 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 066C0F2B .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 066C0067 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 066C00BA .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 066C0095 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 066C0F06 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 066C001E .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 066C0FD4 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 066C0F3C .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 066C0FA8 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 066C0FC3 .text C:\WINDOWS\system32\svchost.exe[3184] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 066C0084 .text C:\WINDOWS\system32\svchost.exe[3184] WS2_32.dll!socket 71AB4211 5 Bytes JMP 0669000A .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 066B0025 .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 066B0F9E .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 066B0014 .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 066B0FD4 .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 066B005B .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 066B0FEF .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegCreateKeyW 77DFBA55 3 Bytes JMP 066B0040 .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegCreateKeyW + 4 77DFBA59 1 Byte [8E] .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 3 Bytes JMP 066B0FB9 .text C:\WINDOWS\system32\svchost.exe[3184] ADVAPI32.dll!RegCreateKeyA + 4 77DFBCF7 1 Byte [8E] .text C:\WINDOWS\system32\svchost.exe[3184] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 066A0FCA .text C:\WINDOWS\system32\svchost.exe[3184] msvcrt.dll!system 77C293C7 5 Bytes JMP 066A0055 .text C:\WINDOWS\system32\svchost.exe[3184] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 066A0029 .text C:\WINDOWS\system32\svchost.exe[3184] msvcrt.dll!_open 77C2F566 5 Bytes JMP 066A0FEF .text C:\WINDOWS\system32\svchost.exe[3184] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 066A0044 .text C:\WINDOWS\system32\svchost.exe[3184] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 066A0018 .text C:\WINDOWS\system32\svchost.exe[3184] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 06680000 .text C:\WINDOWS\system32\svchost.exe[3184] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 0668001B .text C:\WINDOWS\system32\svchost.exe[3184] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 0668002C .text C:\WINDOWS\system32\svchost.exe[3184] WININET.dll!InternetOpenUrlW 3D998439 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[3184] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 0668003D .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01CF0000 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01CF0F77 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01CF0F88 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01CF0062 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01CF0FA5 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01CF0FC0 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01CF009D .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01CF0F4B .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01CF0F15 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01CF00AE .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01CF0EFA .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01CF0047 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01CF0011 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01CF0F66 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01CF0036 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01CF0FDB .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01CF0F3A .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01CE0FDE .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01CE0FB9 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01CE002F .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01CE000A .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01CE006C .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01CE0FEF .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01CE005B .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01CE004A .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01CD0FB0 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] msvcrt.dll!system 77C293C7 5 Bytes JMP 01CD0031 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01CD0FD2 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01CD000C .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01CD0FC1 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01CD0FE3 .text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[3392] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01CC0000 ? C:\WINDOWS\services.exe[3764] number of sections mismatch; unknown module: dnsapi.dll .text C:\WINDOWS\services.exe[3764] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00250000 .text C:\WINDOWS\services.exe[3764] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00250097 .text C:\WINDOWS\services.exe[3764] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00250086 .text C:\WINDOWS\services.exe[3764] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00250075 .text C:\WINDOWS\services.exe[3764] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00250058 .text C:\WINDOWS\services.exe[3764] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0025002C .text C:\WINDOWS\services.exe[3764] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00250F6A .text C:\WINDOWS\services.exe[3764] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00250F7B .text C:\WINDOWS\services.exe[3764] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 002500E8 .text C:\WINDOWS\services.exe[3764] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00250F4F .text C:\WINDOWS\services.exe[3764] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 002500F9 .text C:\WINDOWS\services.exe[3764] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0025003D .text C:\WINDOWS\services.exe[3764] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00250011 .text C:\WINDOWS\services.exe[3764] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 002500A8 .text C:\WINDOWS\services.exe[3764] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00250FC0 .text C:\WINDOWS\services.exe[3764] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00250FDB .text C:\WINDOWS\services.exe[3764] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 002500CD .text C:\WINDOWS\services.exe[3764] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00340042 .text C:\WINDOWS\services.exe[3764] msvcrt.dll!system 77C293C7 5 Bytes JMP 00340027 .text C:\WINDOWS\services.exe[3764] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0034000C .text C:\WINDOWS\services.exe[3764] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00340FEF .text C:\WINDOWS\services.exe[3764] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00340FB7 .text C:\WINDOWS\services.exe[3764] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00340FD2 .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00370FB9 .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00370F83 .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00370FD4 .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00370FEF .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00370040 .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0037000A .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00370F9E .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [57, 88] .text C:\WINDOWS\services.exe[3764] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00370025 .text C:\WINDOWS\services.exe[3764] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00AA0FEF .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01030FEF .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0103007D .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01030F92 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0103006C .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01030FB9 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01030051 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01030F63 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0103009F .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 010300E8 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 010300D7 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01030103 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01030FCA .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0103000A .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 0103008E .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01030036 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01030025 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 010300C6 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00940FC0 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00940F87 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00940FDB .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00940011 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00940044 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00940000 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00940033 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00940022 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00930FCA .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] msvcrt.dll!system 77C293C7 5 Bytes JMP 00930055 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00930029 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00930FEF .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00930044 .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0093000C .text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[3788] WS2_32.dll!socket 71AB4211 5 Bytes JMP 0092000A .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001A0000 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001A0062 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001A0F6D .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001A0F7E .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001A0047 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001A0FB6 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001A00A4 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001A0F5C .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001A00C9 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001A0F30 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001A0F15 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001A0FA5 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001A0011 .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001A007D .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001A002C .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001A0FDB .text C:\WINDOWS\System32\svchost.exe[3876] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001A0F4B .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0029001B .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00290F79 .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0029000A .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00290FCA .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00290040 .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00290FE5 .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00290F94 .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [49, 88] .text C:\WINDOWS\System32\svchost.exe[3876] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00290FA5 .text C:\WINDOWS\System32\svchost.exe[3876] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 003E0049 .text C:\WINDOWS\System32\svchost.exe[3876] msvcrt.dll!system 77C293C7 5 Bytes JMP 003E0038 .text C:\WINDOWS\System32\svchost.exe[3876] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 003E001D .text C:\WINDOWS\System32\svchost.exe[3876] msvcrt.dll!_open 77C2F566 5 Bytes JMP 003E0FEF .text C:\WINDOWS\System32\svchost.exe[3876] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 003E0FD2 .text C:\WINDOWS\System32\svchost.exe[3876] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 003E000C .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001A0000 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001A00BD .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001A00A2 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001A0091 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001A0080 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001A0FDE .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001A00E4 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001A0F9C .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001A0110 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001A00F5 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001A0F5C .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001A0065 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001A0025 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001A0FAD .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001A0FEF .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001A0040 .text C:\WINDOWS\explorer.exe[5084] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001A0F81 .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00290025 .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00290FA8 .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0029000A .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00290FDE .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0029005B .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00290FEF .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0029004A .text C:\WINDOWS\explorer.exe[5084] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00290FC3 .text C:\WINDOWS\explorer.exe[5084] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 002A0047 .text C:\WINDOWS\explorer.exe[5084] msvcrt.dll!system 77C293C7 5 Bytes JMP 002A002C .text C:\WINDOWS\explorer.exe[5084] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 002A0000 .text C:\WINDOWS\explorer.exe[5084] msvcrt.dll!_open 77C2F566 5 Bytes JMP 002A0FEF .text C:\WINDOWS\explorer.exe[5084] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 002A001B .text C:\WINDOWS\explorer.exe[5084] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 002A0FC6 .text C:\WINDOWS\explorer.exe[5084] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 002C0000 .text C:\WINDOWS\explorer.exe[5084] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 002C0FE5 .text C:\WINDOWS\explorer.exe[5084] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 002C0FD4 .text C:\WINDOWS\explorer.exe[5084] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 002C0025 .text C:\WINDOWS\explorer.exe[5084] ws2_32.dll!socket 71AB4211 5 Bytes JMP 01A00000 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0026000A .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0026008E .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00260F99 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00260FB6 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00260FC7 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0026004E .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00260F57 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00260F72 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 002600BA .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00260F2B .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 002600D5 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00260069 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0026001B .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 002600A9 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0026003D .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0026002C .text C:\Program Files\Internet Explorer\iexplore.exe[5128] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00260F46 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00350FC0 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00350F7C .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00350011 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00350FE5 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00350F8D .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00350000 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00350F9E .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [55, 88] .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00350FAF .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E1DF4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E352046 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E351FC7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E35200B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E351F53 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E351F8D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!DialogBoxIndirectParamA 7E456D7D 1 Byte [E9] .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E352081 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E2017EA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00360FBC .text C:\Program Files\Internet Explorer\iexplore.exe[5128] msvcrt.dll!system 77C293C7 5 Bytes JMP 00360047 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00360011 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00360000 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0036002C .text C:\Program Files\Internet Explorer\iexplore.exe[5128] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00360FD7 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E352243 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5128] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 01B70000 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 01B7001B .text C:\Program Files\Internet Explorer\iexplore.exe[5128] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 01B7002C .text C:\Program Files\Internet Explorer\iexplore.exe[5128] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 01B70FE5 .text C:\Program Files\Internet Explorer\iexplore.exe[5128] ws2_32.dll!socket 71AB4211 5 Bytes JMP 02740000 ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 898B82D8 IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F750FDDC] spkp.sys IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F750FE30] spkp.sys IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F74E5042] spkp.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F74E513E] spkp.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F74E50C0] spkp.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F74E5800] spkp.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F74E56D6] spkp.sys IAT \SystemRoot\System32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 892F45E0 IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F74F4B90] spkp.sys ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!GetProcAddress] 00363834 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!LoadLibraryA] 00303033 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!GetModuleHandleA] 322E3139 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!GetTickCount] 352E3730 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!GlobalAlloc] 3037312E IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!GetFileSize] 00003200 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!GlobalFree] 76726573 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!FreeLibrary] 73656369 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!GetCommandLineA] 00000000 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!lstrlenA] 76726573 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!CloseHandle] 73656369 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [kernel32.dll!lstrcatA] 00000000 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!_XcptFilter] 00000000 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!memmove] 006C6564 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!_c_exit] 5C3F5C5C IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!__CxxFrameHandler] 626F6C67 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!_controlfp] 6F726C61 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!_except_handler3] 735C746F IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!__p__commode] 65747379 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!toupper] 6F6F726D IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!__p__fmode] 00005C74 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!exit] 74666F53 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!_adjust_fdiv] 65726177 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!wcstoul] 63694D5C IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!__setusermatherr] 6F736F72 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!wcschr] 575C7466 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!__set_app_type] 6F646E69 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!__getmainargs] 435C7377 IAT C:\WINDOWS\services.exe[484] @ C:\WINDOWS\services.exe [msvcrt.dll!_acmdln] 65727275 IAT C:\WINDOWS\system32\services.exe[768] @ C:\WINDOWS\system32\services.exe [ntdll.dll!NtClose] 7FF70004 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 244C8D51 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 1BC82B04 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 23D0F7C0 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 25C48BC8 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] FFFFF000 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 0A72C83B IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 9459C18B IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 0489008B IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!OpenThreadToken] 002DC324 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 85000010 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] E9E9EB00 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!RegCloseKey] 00008FD2 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 042474FF IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] 009003E8 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] B18001C7 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!lstrlenW] F6C30990 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LocalFree] 01042444 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetCurrentProcess] C7F18B56 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetCurrentThread] 90B18006 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetProcAddress] 56077409 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 008FDBE8 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LCMapStringW] FF505608 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!FreeLibrary] 330C2474 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!lstrcpyW] 95E4E8F6 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] C0850000 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!lstrcmpiW] 087E5959 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!ExitProcess] 15FF4650 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetCommandLineW] [0990B13C] C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] C35EC68B IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetProcessHeap] 83EC8B55 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!SetErrorMode] 575318EC IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] F868DB33 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] 890990B1 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 5D89F05D IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryA] 2C15FFE8 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 680990B1 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetTickCount] [0990B1E8] C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] FFEC4589 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] 90B07C15 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 3BF88B09 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!TerminateProcess] F47D89FB IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] C0330775 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LocalAlloc] 0000EAE9 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!lstrcmpW] 358B5600 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] [0990B078] C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!NtQuerySecurityObject] D6FF5709 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlFreeHeap] 90B1CC68 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!NtOpenKey] 45895709 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!wcscat] 68D6FFF8 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!wcscpy] [0990B1B8] C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlAllocateHeap] 8BF475FF IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] 39D6FFF8 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 840FF85D IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlInitializeSid] 000000AF IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] 840FFB3B IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 000000A7 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!NtClose] 840FC33B IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] 0000009F IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] 51F04D8D IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] FFEC75FF IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlGetAce] 7415FFD0 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlImageNtHeader] 3B0990B0 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!wcslen] EC4589C3 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 008E840F IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [ntdll.dll!RtlCopySid] 88BE0000 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 15FF5053 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] [0990B070] C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] FB3BF88B IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] 458D7A74 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcServerListen] 895750FC IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 55FFFC75 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 6FF883F8 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 75FF1075 IAT C:\WINDOWS\system32\svchost.exe[3184] @ C:\WINDOWS\system32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] FF5357FC IAT C:\WINDOWS\system32\mfevtps.exe[3676] @ C:\WINDOWS\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [00405995] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.) IAT C:\WINDOWS\system32\mfevtps.exe[3676] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [004059CB] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.) IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!GetProcAddress] 00363834 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!LoadLibraryA] 00303033 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!GetModuleHandleA] 322E3139 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!GetTickCount] 352E3730 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!GlobalAlloc] 3037312E IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!GetFileSize] 00003200 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!GlobalFree] 76726573 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!FreeLibrary] 73656369 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!GetCommandLineA] 00000000 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!lstrlenA] 76726573 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!CloseHandle] 73656369 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [kernel32.dll!lstrcatA] 00000000 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!_XcptFilter] 00000000 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!memmove] 006C6564 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!_c_exit] 5C3F5C5C IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!__CxxFrameHandler] 626F6C67 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!_controlfp] 6F726C61 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!_except_handler3] 735C746F IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!__p__commode] 65747379 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!toupper] 6F6F726D IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!__p__fmode] 00005C74 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!exit] 74666F53 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!_adjust_fdiv] 65726177 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!wcstoul] 63694D5C IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!__setusermatherr] 6F736F72 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!wcschr] 575C7466 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!__set_app_type] 6F646E69 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!__getmainargs] 435C7377 IAT C:\WINDOWS\services.exe[3764] @ C:\WINDOWS\services.exe [msvcrt.dll!_acmdln] 65727275 ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs ykdktedr.sys Device \FileSystem\Ntfs \Ntfs 898481F8 AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.) Device \FileSystem\Mup \Dfs ykdktedr.sys Device \FileSystem\NetBIOS \Device\Netbios ykdktedr.sys AttachedDevice \Driver\Tcpip \Device\Ip mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.) Device \Driver\usbohci \Device\USBPDO-0 892E1500 Device \FileSystem\RAW \Device\RawTape ykdktedr.sys Device \FileSystem\MRxDAV \Device\WebDavRedirector ykdktedr.sys AttachedDevice \Driver\Tcpip \Device\Tcp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.) Device \Driver\Ftdisk \Device\HarddiskVolume1 8984A1F8 Device \Driver\Ftdisk \Device\HarddiskVolume2 8984A1F8 Device \Driver\Cdrom \Device\CdRom0 89332500 Device \Driver\USBSTOR \Device\00000072 88AF11F8 Device \FileSystem\Rdbss \Device\FsWrap ykdktedr.sys Device \Driver\Ftdisk \Device\HarddiskVolume3 8984A1F8 Device \Driver\atapi \Device\Ide\IdePort0 [F7849B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 [F7849B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdePort1 [F7849B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c [F7849B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-17 [F7849B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\USBSTOR \Device\00000073 88AF11F8 Device \Driver\Ftdisk \Device\HarddiskVolume4 8984A1F8 Device \Driver\Ftdisk \Device\HarddiskVolume5 8984A1F8 Device \Driver\NetBT \Device\NetBt_Wins_Export 88B121F8 Device \Driver\PCI_PNP4760 \Device\0000004a spkp.sys Device \Driver\PCI_PNP4760 \Device\0000004a spkp.sys Device \Driver\NetBT \Device\NetbiosSmb 88B121F8 Device \FileSystem\Srv \Device\LanmanServer ykdktedr.sys AttachedDevice \Driver\Tcpip \Device\Udp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\RawIp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.) Device \FileSystem\RAW \Device\RawDisk ykdktedr.sys Device \Driver\usbohci \Device\USBFDO-0 892E1500 Device \Driver\nvata \Device\NvAta0 898491F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver ykdktedr.sys Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 88AF21F8 Device \Driver\NetBT \Device\NetBT_Tcpip_{1C662C24-7338-40DA-A9B2-694DCD335C8A} 88B121F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector ykdktedr.sys Device \FileSystem\MRxSmb \Device\LanmanRedirector 88AF21F8 Device \FileSystem\Npfs \Device\NamedPipe ykdktedr.sys Device \Driver\Ftdisk \Device\FtControl 8984A1F8 Device \FileSystem\Msfs \Device\Mailslot ykdktedr.sys Device \FileSystem\RAW \Device\RawCdRom ykdktedr.sys Device \Driver\adzjxui4 \Device\Scsi\adzjxui41 893BD500 Device \Driver\sptd \Device\1402046010 spkp.sys Device \FileSystem\Mup \Device\WinDfs\Root ykdktedr.sys Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer ykdktedr.sys Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer ykdktedr.sys Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer ykdktedr.sys Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer ykdktedr.sys Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer ykdktedr.sys Device \FileSystem\Cdfs \Cdfs ykdktedr.sys Device \FileSystem\Cdfs \Cdfs 88AAD1F8 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xFB 0xC4 0x2B 0xA4 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x87 0x37 0xF0 0x9B ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x15 0xE3 0x6F 0x67 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x3B 0x9A 0x94 0x9B ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xFB 0xC4 0x2B 0xA4 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x87 0x37 0xF0 0x9B ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x15 0xE3 0x6F 0x67 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x3B 0x9A 0x94 0x9B ... ---- Files - GMER 1.0.15 ---- ADS C:\System Volume Information\_restore{899BDE5B-1249-4C53-BC6E-D697D68F5797}\RP336\A0044019.exe:userini.exe 55296 bytes executable ---- EOF - GMER 1.0.15 ----