Windows 7: UDP Flood aus meinem Netzwerk, Trojaner?

TattooPanda · 14.09.2013, 14:03

Hallo Community.

Ich habe bereits mein "Problem" in folgendem Thread geschildert
http://www.trojaner-board.de/141432-...-netzwerk.html

Auf Anraten bitte ich nun um Check meiner Logs bzw Hilfe bei der Überprüfung auf einen Trojaner o.ä.

Gmer- und FRST-Log aufgrund der Größe leider gezippt als Anhang.

Vielen Dank schonmal!

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:41 on 14/09/2013 (Swift)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-09-2013 04
Ran by Swift at 2013-09-14 14:42:51
Running from C:\Users\Swift\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Action! (x32 Version: 1.16.0)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
America's Army: Proving Grounds Beta (x32)
Arc (x32 Version: 1.0.0.5510)
ATI Catalyst Install Manager (Version: 3.0.762.0)
Audacity 2.0.3 (x32 Version: 2.0.3)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
AVerMedia A835 USB DVB-T 8.2.64.64 (x32 Version: 8.2.64.64)
AVerTV 3D (x32 Version: 6.5.2.14)
Bandicam (x32 Version: 1.9.0.397)
Bandisoft MPEG-1 Decoder (x32)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlelog Web Plugins (x32 Version: 2.1.7)
Bully: Scholarship Edition (x32)
Burnout Paradise: The Ultimate Box (x32)
CCleaner (Version: 4.05)
CDBurnerXP (x32 Version: 4.5.2.4255)
Counter-Strike (x32)
Counter-Strike: Global Offensive (x32)
DAEMON Tools Lite (x32 Version: 4.47.1.0333)
Darksiders (x32)
DHTML Editing Component (x32 Version: 6.02.0001)
DiRT Showdown (x32)
Dota 2 (x32)
ESET Online Scanner v3 (x32)
ESN Sonar (x32 Version: 0.70.4)
EVGA Precision X 4.2.1 (x32 Version: 4.2.1)
Foxit Reader (x32 Version: 6.0.6.722)
Free Video Dub version 2.0.21.827 (x32 Version: 2.0.21.827)
Free YouTube to MP3 Converter version 3.12.11.812 (x32 Version: 3.12.11.812)
GeForce Experience NvStream Client Components (Version: 0.1.87)
Google Chrome (x32 Version: 29.0.1547.66)
Google Update Helper (x32 Version: 1.3.21.153)
Hitman: Sniper Challenge (x32)
Jasc Paint Shop Pro 9 (x32 Version: 9.00.0000)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
JDownloader 0.9 (x32 Version: 0.9)
Lexmark X1100 Series
Logitech Gaming Software (Version: 8.45.88)
Logitech Gaming Software 8.50 (Version: 8.50.281)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Corporation (Version: 9.1.0.0)
Microsoft Corporation (x32 Version: 9.1.0.0)
Microsoft LifeCam (Version: 3.60.253.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MozBackup 1.5.1 (x32)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.20.0)
Nmap 5.20 (x32)
NVIDIA 3D Vision Controller-Treiber 320.49 (Version: 320.49)
NVIDIA 3D Vision Treiber 320.49 (Version: 320.49)
NVIDIA GeForce Experience 1.6.1 (Version: 1.6.1)
NVIDIA Grafiktreiber 320.49 (Version: 320.49)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2)
NVIDIA Install Application (Version: 2.1002.133.902)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2049)
NVIDIA Systemsteuerung 320.49 (Version: 320.49)
NVIDIA Update 8.3.14 (Version: 8.3.14)
NVIDIA Update Components (Version: 8.3.14)
NVIDIA Virtual Audio 1.2.5 (Version: 1.2.5)
OpenAL (x32)
OpenOffice 4.0.0 (x32 Version: 4.00.9702)
Origin (x32 Version: 9.3.2.2730)
PAYDAY 2 (x32)
PDFCreator (x32 Version: 1.7.1)
PunkBuster Services (x32 Version: 0.991)
Rapture3D 2.4.11 Game (x32)
Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.23.623.2010)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6151)
Recuva (Version: 1.48)
Samsung Kies (x32 Version: 2.6.0.13064_2)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.27.0)
SHIELD Streaming (Version: 1.05.28)
Skype™ 6.7 (x32 Version: 6.7.102)
Spec Ops: The Line (x32)
Spybot - Search & Destroy (x32 Version: 2.1.21)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (Version: 3.0.12)
TeamViewer 8 (x32 Version: 8.0.20768)
Turbo Lister 2 (x32 Version: 2.00.0000)
TV Movie ClickFinder (x32 Version: 1.00.0000)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
VLC media player 2.0.8 (Version: 2.0.8)
WebConnect 3.0.0 (Version: 3.0.0)
Winamp (x32 Version: 5.65 )
WinPcap 4.1.3 (x32 Version: 4.1.0.2980)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
Wireshark 1.10.2 (64-bit) (x32 Version: 1.10.2)
World of Tanks (x32)
XnView 2.04 (x32 Version: 2.04)

==================== Restore Points  =========================

13-09-2013 16:48:36 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-08-28 15:38 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {0E12E6CA-FF12-44BC-BF83-5A5E5B42BDDC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-27] (Google Inc.)
Task: {5215C9BE-8696-4E6C-BA65-B6F4DF14E575} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-27] (Google Inc.)
Task: {7607F600-522D-4456-BC63-DFCC3FDCC945} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {7BB95E81-8C95-4CCF-8E55-308E2C28FD4B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {864A7F7B-7840-4A37-BFF0-F04130B1BFE3} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {DA3709EF-8478-4A46-87B2-0A19CA1F8AD5} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {E8A950B0-8976-439A-B8A6-122EA3314927} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {F3A70570-C60B-4047-831D-2F08AEF4AAA3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-08-29 20:45 - 2012-11-23 05:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2009-07-14 01:37 - 2009-07-14 03:39 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\Dwm.exe
2013-08-27 05:47 - 2011-02-25 08:19 - 02871808 _____ (Microsoft Corporation) C:\Windows\Explorer.EXE
2013-08-27 07:23 - 2012-06-09 19:20 - 00196096 _____ (Alexander Roshal) C:\Program Files\WinRAR\rarext.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 11057768 _____ (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
2013-08-27 05:24 - 2013-06-21 14:06 - 27781920 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.DLL
2013-08-28 17:37 - 2008-02-28 11:58 - 00074408 _____ (Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe
2013-08-28 17:37 - 2008-02-28 11:57 - 00058024 _____ (Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe
2012-01-24 20:12 - 2012-01-24 20:12 - 00651264 _____ (E.W.E.-Software) C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe
2013-07-15 19:21 - 2013-07-15 19:21 - 01564016 _____ (Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
2013-08-28 03:42 - 2012-10-17 23:24 - 00163840 _____ () C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
2013-08-28 03:42 - 2011-05-20 00:20 - 00675840 _____ (AVerMedia TECHNOLOGIES, Inc.) C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
2013-08-28 03:34 - 2004-09-17 14:50 - 00019968 _____ (www.counter-strike.de - MUff[99]) C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe
2013-08-27 05:45 - 2011-05-04 07:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2013-09-14 14:40 - 2013-09-14 14:40 - 01950312 _____ (Farbar) C:\Users\Swift\Desktop\FRST64.exe
2009-07-14 01:59 - 2009-07-14 03:39 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\DllHost.exe
2012-01-24 20:11 - 2012-01-24 20:11 - 00040960 _____ (E.W.E.-Software) C:\Program Files (x86)\TV Movie\TV Movie ClickFinder\resizer.ocx
2013-06-14 19:58 - 2013-06-14 19:58 - 00307200 _____ ( MarkAny.) C:\Program Files (x86)\Samsung\Kies\External\MACSSDK.dll
2013-07-15 19:16 - 2013-07-15 19:16 - 00250368 _____ (Windows (R) Codename Longhorn DDK provider) C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\UPNPDevice_Kies.dll
2013-09-12 21:00 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-09-12 21:00 - 2013-05-16 10:55 - 03643800 _____ (Project JEDI) C:\Program Files (x86)\Spybot - Search & Destroy 2\Jcl150.bpl
2013-09-12 21:00 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-09-04 13:23 - 2013-09-02 22:35 - 00709584 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\libglesv2.dll
2013-09-04 13:23 - 2013-09-02 22:35 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\libegl.dll
2013-09-04 13:23 - 2013-09-02 22:35 - 04053456 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll
2013-09-04 13:23 - 2013-09-02 22:35 - 00410576 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
2013-09-04 13:23 - 2013-09-02 22:35 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll
2013-09-04 13:23 - 2013-09-02 22:35 - 13599184 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/13/2013 06:42:17 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/12/2013 08:47:04 PM) (Source: Application Hang) (User: )
Description: Programm onlineeye.exe, Version 1.0.2.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1e18

Startzeit: 01ceafe86427c905

Endzeit: 9

Anwendungspfad: C:\Program Files (x86)\Onlineeye\onlineeye.exe

Berichts-ID: b2c4e12e-1bdb-11e3-b447-485b39eeb8d8

Error: (09/12/2013 08:46:26 PM) (Source: Onlineeye Firewall Service) (User: )
Description: -858128380

Error: (09/12/2013 07:32:58 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/12/2013 01:13:25 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (09/12/2013 01:13:25 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (09/12/2013 01:13:25 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (09/11/2013 07:52:05 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/10/2013 07:48:13 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/10/2013 07:10:09 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (09/14/2013 01:04:20 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (09/12/2013 08:46:26 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Onlineeye Firewall Service" wurde mit folgendem Fehler beendet: 
%%-858128380

Error: (09/12/2013 08:46:26 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Onlineeye Firewall Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (09/12/2013 07:41:19 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (09/12/2013 03:26:24 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{8C5A44E6-98E3-4C2C-A554-1BF0F4234C10}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (09/10/2013 01:04:51 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎10.‎09.‎2013 um 13:03:03 unerwartet heruntergefahren.

Error: (09/10/2013 02:18:42 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/10/2013 02:18:42 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (09/09/2013 03:07:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (09/09/2013 03:07:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (09/13/2013 06:42:17 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (09/12/2013 08:47:04 PM) (Source: Application Hang)(User: )
Description: onlineeye.exe1.0.2.21e1801ceafe86427c9059C:\Program Files (x86)\Onlineeye\onlineeye.exeb2c4e12e-1bdb-11e3-b447-485b39eeb8d8

Error: (09/12/2013 08:46:26 PM) (Source: Onlineeye Firewall Service)(User: )
Description: -858128380

Error: (09/12/2013 07:32:58 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (09/12/2013 01:13:25 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (09/12/2013 01:13:25 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (09/12/2013 01:13:25 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (09/11/2013 07:52:05 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (09/10/2013 07:48:13 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (09/10/2013 07:10:09 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe


CodeIntegrity Errors:
===================================
  Date: 2013-08-28 15:38:34.139
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-28 15:38:34.092
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 38%
Total physical RAM: 8191.05 MB
Available physical RAM: 5071.41 MB
Total Pagefile: 16380.29 MB
Available Pagefile: 12328.19 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:100 GB) (Free:47.49 GB) NTFS
Drive d: (Volume) (Fixed) (Total:400 GB) (Free:327.31 GB) NTFS
Drive e: (Volume) (Fixed) (Total:215.71 GB) (Free:151.26 GB) NTFS
Drive f: (Volume) (Fixed) (Total:215.71 GB) (Free:128.47 GB) NTFS
Drive g: (Volume) (Fixed) (Total:20 GB) (Free:18.81 GB) NTFS
Drive j: (Volume) (Fixed) (Total:212.88 GB) (Free:43.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 0CF63428)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=400 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=431 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 233 GB) (Disk ID: 698A5CBD)
Partition 1: (Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=213 GB) - (Type=OF Extended)

==================== End Of Log ============================

schrauber · 14.09.2013, 18:50

Hi,

Logs bitte immer in den Thread posten, zur Not stückeln und mehrere Posts verwenden.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

TattooPanda · 14.09.2013, 19:12

Alles klar =)
Aber das werden viele posts, die logs sind riesig.

FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-09-2013 04
Ran by Swift (administrator) on SWIFT-PC on 14-09-2013 14:41:35
Running from C:\Users\Swift\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(AVerMedia TECHNOLOGIES, Inc.) C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe
( ) C:\Windows\system32\lxbkcoms.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(WebConnect) C:\Program Files (x86)\WebConnect\updateWebConnect.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe
(E.W.E.-Software) C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(AVerMedia TECHNOLOGIES, Inc.) C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(www.counter-strike.de - MUff[99]) C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11057768 2013-08-27] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [8290584 2013-08-01] (Logitech Inc.)
HKLM\...\Run: [lxbkbmgr.exe] - C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmgr.exe [74408 2008-02-28] (Lexmark International, Inc.)
HKCU\...\Run: [TVTip] - C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvstart.exe [102400 2012-01-24] (E.W.E.-Software)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-15] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113296 2010-03-30] (NEC Electronics Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-15] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [LifeCam] - C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Startup: C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe (www.counter-strike.de - MUff[99])
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA2FAD277EEA2CE01
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: WebConnect - {2316c625-b487-4410-a1a5-ff040b65245f} - C:\Program Files (x86)\WebConnect\WebConnectbho.dll (Web Connect)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - e:\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Swift\AppData\Roaming\Mozilla\Firefox\Profiles\ulmzb788.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin - e:\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Swift\AppData\Roaming\Mozilla\Firefox\Profiles\ulmzb788.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: firefox - C:\Users\Swift\AppData\Roaming\Mozilla\Firefox\Profiles\ulmzb788.default\Extensions\firefox@webconnect.co.xpi
FF Extension: youtubeunblocker - C:\Users\Swift\AppData\Roaming\Mozilla\Firefox\Profiles\ulmzb788.default\Extensions\youtubeunblocker@unblocker.yt.xpi
FF Extension: No Name - C:\Users\Swift\AppData\Roaming\Mozilla\Firefox\Profiles\ulmzb788.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi
FF Extension: No Name - C:\Users\Swift\AppData\Roaming\Mozilla\Firefox\Profiles\ulmzb788.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Swift\AppData\Roaming\Mozilla\Firefox\Profiles\ulmzb788.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR Extension: (Google Drive) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1
CHR Extension: (YouTube) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1
CHR Extension: (Google Search) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1
CHR Extension: (AdBlock) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.7_0
CHR Extension: (Session Manager) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\mghenlmbmjcpehccoangkdpagbcbkdpc\3.4.5_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (YouTube Unblocker) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl\0.4.5_0
CHR Extension: (Gmail) - C:\Users\Swift\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2
CHR HKLM-x32\...\Chrome\Extension: [ieakfmpjhljbpbfpldjkddkjmmgjmgon] - C:\Program Files (x86)\WebConnect\ieakfmpjhljbpbfpldjkddkjmmgjmgon.crx

==================== Services (Whitelisted) =================

S3 ArcService; e:\Arc\ArcService.exe [88424 2013-08-28] (Perfect World Entertainment Inc)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [360448 2011-08-19] (AVerMedia)
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [403456 2011-04-01] ()
R2 AVerUpdateServer; C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe [167936 2011-10-31] (AVerMedia TECHNOLOGIES, Inc.)
R2 lxbk_device; C:\Windows\system32\lxbkcoms.exe [565928 2008-02-19] ( )
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-27] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-31] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 Update WebConnect; C:\Program Files (x86)\WebConnect\updateWebConnect.exe [206632 2013-08-30] (WebConnect)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-08-27] ()
S3 AVerAF35; C:\Windows\System32\Drivers\AVerAF35.sys [804736 2012-11-29] (AVerMedia TECHNOLOGIES, Inc.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-08-27] (DT Soft Ltd)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
R3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [41752 2013-05-30] (Logitech Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)
S3 RTCore64; C:\Program Files (x86)\EVGA Precision X\RTCore64.sys [15176 2013-07-18] ()
S3 RTCore64; C:\Program Files (x86)\EVGA Precision X\RTCore64.sys [15176 2013-07-18] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-14 14:41 - 2013-09-14 14:41 - 00000542 _____ C:\Users\Swift\Desktop\defogger_disable.log
2013-09-14 14:41 - 2013-09-14 14:41 - 00000168 _____ C:\Users\Swift\defogger_reenable
2013-09-14 14:41 - 2013-09-14 14:41 - 00000000 ____D C:\FRST
2013-09-14 14:40 - 2013-09-14 14:40 - 01950312 _____ (Farbar) C:\Users\Swift\Downloads\FRST64.exe
2013-09-14 14:40 - 2013-09-14 14:40 - 01950312 _____ (Farbar) C:\Users\Swift\Desktop\FRST64.exe
2013-09-14 14:40 - 2013-09-14 14:40 - 00377856 _____ C:\Users\Swift\Downloads\gmer_2.1.19163.exe
2013-09-14 14:40 - 2013-09-14 14:40 - 00377856 _____ C:\Users\Swift\Desktop\gmer_2.1.19163.exe
2013-09-14 14:40 - 2013-09-14 14:39 - 00050477 _____ C:\Users\Swift\Desktop\Defogger.exe
2013-09-14 14:39 - 2013-09-14 14:39 - 00050477 _____ C:\Users\Swift\Downloads\Defogger.exe
2013-09-14 13:03 - 2013-09-14 13:04 - 28733944 _____ (VSO Software                                                ) C:\Users\Swift\Downloads\vso_video_converter_setup.exe
2013-09-14 13:02 - 2013-09-14 13:03 - 06217076 _____ (XMedia Recode                                               ) C:\Users\Swift\Downloads\XMediaRecode3172_setup.exe
2013-09-14 00:42 - 2013-09-14 02:53 - 00000000 ____D C:\Program Files (x86)\EVGA Precision X
2013-09-14 00:42 - 2013-09-14 00:42 - 00001092 _____ C:\Users\Swift\Desktop\EVGA Precision X.lnk
2013-09-14 00:42 - 2013-09-14 00:42 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EVGA Precision X
2013-09-14 00:41 - 2013-09-14 00:42 - 16048384 _____ C:\Users\Swift\Downloads\EVGA_PrecisionX_Setup_421.exe
2013-09-13 15:40 - 2011-07-25 12:40 - 00300832 _____ (Sysinternals - www.sysinternals.com) C:\Users\Swift\Desktop\Tcpview.exe
2013-09-13 15:02 - 2013-09-13 15:02 - 13499678 _____ C:\Users\Swift\Downloads\reallydeep.wmv
2013-09-13 15:01 - 2013-09-13 15:01 - 23069374 _____ C:\Users\Swift\Downloads\ff-kado.wmv
2013-09-13 15:01 - 2013-09-13 15:01 - 12660008 _____ C:\Users\Swift\Downloads\twerking.wmv
2013-09-13 15:00 - 2013-09-13 15:00 - 07803463 _____ C:\Users\Swift\Downloads\13091206.zip
2013-09-13 14:34 - 2013-09-13 14:34 - 00291606 _____ C:\Users\Swift\Downloads\TCPView.zip
2013-09-12 21:19 - 2013-09-12 21:19 - 00000000 ____D C:\Users\Swift\Documents\ProcAlyzer Dumps
2013-09-12 21:15 - 2013-09-12 21:15 - 00377920 _____ (AVAST Software) C:\Users\Swift\Downloads\aswclear.exe
2013-09-12 21:00 - 2013-09-12 21:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-12 21:00 - 2013-09-12 21:00 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-09-12 21:00 - 2013-09-12 21:00 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-09-12 21:00 - 2013-09-12 21:00 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-09-12 21:00 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-09-12 20:46 - 2013-09-12 20:46 - 00000119 _____ C:\Windows\onlineeye.INI
2013-09-12 20:45 - 2013-09-12 20:45 - 06418833 _____ (pmaSoft) C:\Users\Swift\Downloads\onlineeye.exe
2013-09-12 20:34 - 2013-09-12 20:36 - 00000000 ____D C:\Users\Swift\.zenmap
2013-09-12 20:29 - 2013-09-12 20:29 - 00000967 _____ C:\Users\Swift\Desktop\Nmap - Zenmap GUI.lnk
2013-09-12 20:29 - 2013-09-12 20:29 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nmap
2013-09-12 20:28 - 2013-09-12 20:28 - 00000000 ____D C:\Program Files (x86)\Nmap
2013-09-12 17:02 - 2013-09-12 17:02 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Wireshark
2013-09-12 16:54 - 2013-09-12 17:02 - 00000000 ____D C:\Program Files\Wireshark
2013-09-12 16:54 - 2013-09-12 16:54 - 00000000 ____D C:\Program Files (x86)\WinPcap
2013-09-12 14:44 - 2013-09-12 15:16 - 00000000 ____D C:\Users\Swift\Desktop\Seramis
2013-09-11 23:32 - 2013-09-11 23:32 - 00000000 ____D C:\Users\Swift\dwhelper
2013-09-11 17:28 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 17:28 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 17:28 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 17:28 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 17:28 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 17:28 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 17:28 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 17:28 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-11 17:28 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-11 17:28 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-11 17:28 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 17:28 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-11 17:28 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-11 17:28 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 17:12 - 2013-09-11 17:14 - 73651730 _____ C:\Users\Swift\Downloads\13091102.zip
2013-09-11 17:11 - 2013-09-11 17:12 - 04319464 _____ C:\Users\Swift\Downloads\bbw-beans.wmv
2013-09-11 14:56 - 2013-09-11 14:56 - 05705512 _____ C:\Users\Swift\Downloads\bitdefender14_tsecurity.exe
2013-09-11 14:45 - 2013-09-11 14:45 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Canneverbe Limited
2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2013-09-11 14:34 - 2013-09-11 14:34 - 08435446 _____ C:\Users\Swift\Downloads\nietmooiwelgeil.wmv
2013-09-11 14:34 - 2013-09-11 14:34 - 05607766 _____ C:\Users\Swift\Downloads\goodanal.wmv
2013-09-11 14:32 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 14:32 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-11 14:32 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-11 14:32 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-11 14:32 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-11 14:32 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-11 14:32 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-11 14:32 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-11 14:32 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-11 14:32 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-11 14:32 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 14:32 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 14:32 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 14:32 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 14:32 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 14:32 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-11 14:32 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-11 14:32 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 14:32 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 14:32 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 14:32 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 14:32 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 14:32 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 14:32 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-11 14:32 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-11 14:32 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 14:32 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 02:22 - 2013-09-11 02:22 - 00000000 ____D C:\Users\Swift\Documents\Bandicam
2013-09-11 02:22 - 2013-09-11 02:22 - 00000000 ____D C:\Users\Swift\AppData\Roaming\BANDISOFT
2013-09-11 02:21 - 2013-09-11 02:21 - 00000992 _____ C:\Users\UpdatusUser\Desktop\Bandicam.lnk
2013-09-11 02:21 - 2013-09-11 02:21 - 00000992 _____ C:\Users\Swift\Desktop\Bandicam.lnk
2013-09-11 02:21 - 2013-09-11 02:21 - 00000000 ____D C:\Program Files (x86)\BandiMPEG1
2013-09-11 02:21 - 2013-09-11 02:21 - 00000000 ____D C:\Program Files (x86)\Bandicam
2013-09-11 01:55 - 2013-09-11 01:56 - 58140330 _____ C:\Users\Swift\Downloads\13091002.zip
2013-09-11 01:12 - 2013-09-11 01:13 - 77882478 _____ C:\Users\Swift\Downloads\13091003.zip
2013-09-11 01:08 - 2013-09-14 01:24 - 00002936 _____ C:\Windows\windefendam.log
2013-09-11 01:08 - 2013-09-14 01:24 - 00000020 _____ C:\Windows\capsys184523.log
2013-09-11 01:08 - 2013-09-13 00:08 - 00000000 ____D C:\Users\Swift\AppData\Local\Mirillis
2013-09-11 01:08 - 2013-09-11 01:08 - 00000000 ____D C:\Users\Swift\Documents\Action!
2013-09-11 01:08 - 2013-09-11 01:08 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Mirillis
2013-09-11 01:08 - 2013-09-11 01:08 - 00000000 ____D C:\ProgramData\Mirillis
2013-09-11 01:07 - 2013-09-11 01:07 - 00002039 _____ C:\Users\Public\Desktop\Action!.lnk
2013-09-11 01:07 - 2013-09-11 01:07 - 00000000 ____D C:\Program Files (x86)\Mirillis
2013-09-11 00:52 - 2013-09-11 00:52 - 19714720 _____ (Mirillis Ltd.) C:\Users\Swift\Downloads\action_1_16_0_setup.exe
2013-09-10 01:02 - 2013-09-10 01:03 - 14377758 _____ C:\Users\Swift\Downloads\hm-heavyorgasm.wmv
2013-09-10 01:02 - 2013-09-10 01:03 - 13011976 _____ C:\Users\Swift\Downloads\ongelegen.wmv
2013-09-10 00:50 - 2013-09-10 00:50 - 03603611 _____ C:\Users\Swift\Downloads\13090906.zip
2013-09-09 18:54 - 2013-09-09 19:00 - 00000000 ____D C:\Users\Swift\Documents\America's Army
2013-09-09 16:24 - 2013-09-09 16:44 - 2004488510 _____ C:\Users\Swift\Downloads\zak2install.zip
2013-09-09 02:53 - 2013-09-09 02:53 - 04856260 _____ C:\Users\Swift\Downloads\groenteisbinnen.wmv
2013-09-08 22:51 - 2013-09-11 02:25 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Audacity
2013-09-08 22:50 - 2013-09-08 22:50 - 00001011 _____ C:\Users\Swift\Desktop\Audacity.lnk
2013-09-08 22:50 - 2013-09-08 22:50 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-09-08 22:49 - 2013-09-08 22:49 - 21281052 _____ (Audacity Team                                               ) C:\Users\Swift\Downloads\audacity-win-2.0.3.exe
2013-09-08 21:04 - 2013-09-08 21:05 - 00001510 _____ C:\Users\Swift\Desktop\Skype 2.lnk
2013-09-08 02:42 - 2013-09-08 02:42 - 00000000 ____D C:\Users\Swift\AppData\Roaming\dvdcss
2013-09-08 02:37 - 2013-09-08 02:37 - 28813902 _____ C:\Users\Swift\Downloads\Ultimate_Bruce_Lee_1.0.zip
2013-09-08 02:37 - 2013-09-08 02:37 - 00032783 _____ C:\Users\Swift\Downloads\rick32.zip
2013-09-08 02:36 - 2013-09-08 02:37 - 04012014 _____ C:\Users\Swift\Downloads\DONKEY_KONG_1.0.zip
2013-09-08 02:35 - 2013-09-08 02:35 - 06598337 _____ C:\Users\Swift\Downloads\Maniac Mansion 14.exe
2013-09-07 17:59 - 2013-09-07 17:59 - 00002041 _____ C:\Users\Swift\Desktop\JDownloader.lnk
2013-09-07 17:58 - 2013-09-08 19:17 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-09-07 17:58 - 2013-09-07 17:58 - 00000000 ____D C:\Program Files (x86)\WebConnect
2013-09-07 02:41 - 2013-09-07 03:04 - 00000000 ____D C:\Users\Swift\AppData\Roaming\TeamViewer
2013-09-07 01:56 - 2013-09-07 02:44 - 207465754 _____ C:\Users\Swift\Downloads\13090606.zip
2013-09-07 01:48 - 2013-09-07 01:48 - 54998657 _____ C:\Users\Swift\Downloads\100_hotties.zip
2013-09-06 03:03 - 2013-09-06 14:28 - 00000000 ____D C:\Users\Swift\Downloads\Laptop Treiber
2013-09-05 22:50 - 2013-09-05 22:50 - 00000000 ____D C:\Program Files\Microsoft LifeCam
2013-09-05 22:50 - 2013-09-05 22:50 - 00000000 ____D C:\Program Files (x86)\Microsoft LifeCam
2013-09-05 21:11 - 2013-09-05 21:11 - 00002517 _____ C:\Users\Swift\Desktop\Skype.lnk
2013-09-05 15:02 - 2013-09-05 15:02 - 00000048 _____ C:\MyUpdateLogs.log
2013-09-05 15:00 - 2013-09-05 15:00 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-09-05 15:00 - 2013-09-05 15:00 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2013-09-05 14:22 - 2013-09-05 14:22 - 00162556 _____ C:\Users\Swift\Downloads\sxv185.zip
2013-09-04 16:51 - 2013-09-04 17:14 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Winamp
2013-09-04 16:51 - 2013-09-04 16:51 - 00000000 ____D C:\Program Files (x86)\Winamp
2013-09-03 23:46 - 2013-09-10 20:00 - 00000000 ____D C:\Users\Swift\Documents\AVerTV
2013-09-03 15:44 - 2013-09-03 15:44 - 00000000 ____D C:\Program Files\Recuva
2013-09-03 14:39 - 2013-09-14 02:53 - 00000000 ____D C:\Users\Swift\AppData\Roaming\vlc
2013-09-03 02:38 - 2013-08-20 15:33 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-09-03 02:38 - 2013-08-20 15:32 - 00028448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-09-01 23:45 - 2013-06-14 19:57 - 04659712 _____ (Dmitry Streblechenko) C:\Windows\SysWOW64\Redemption.dll
2013-09-01 23:45 - 2013-06-14 19:56 - 00821824 _____ (Devguru Co., Ltd.) C:\Windows\SysWOW64\dgderapi.dll
2013-09-01 23:44 - 2013-09-01 23:46 - 00000000 ____D C:\ProgramData\Samsung
2013-09-01 23:44 - 2013-09-01 23:46 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-08-31 20:58 - 2013-08-31 20:58 - 00003178 _____ C:\Windows\System32\Tasks\{BD422873-5948-4239-AF84-1A0AC5434403}
2013-08-31 20:58 - 2013-08-31 20:58 - 00000000 ____D C:\Users\Swift\Downloads\it222deu
2013-08-31 20:49 - 2013-08-31 20:49 - 239417738 _____ C:\Users\Swift\Documents\backup.reg
2013-08-31 20:47 - 2013-08-31 20:47 - 04445476 _____ (Logitech                                                    ) C:\Users\Swift\Downloads\it222deu.exe
2013-08-31 20:38 - 2013-09-04 13:17 - 00000000 ____D C:\Users\Swift\AppData\Roaming\XnView
2013-08-31 20:38 - 2013-08-31 20:38 - 00000000 ____D C:\Program Files (x86)\XnView
2013-08-31 19:51 - 2013-09-13 20:33 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-31 19:51 - 2013-09-09 19:01 - 00000000 ____D C:\Users\Swift\AppData\Local\PunkBuster
2013-08-31 19:51 - 2013-08-31 19:51 - 00000000 ____D C:\Users\Swift\Documents\Battlefield 3
2013-08-31 19:50 - 2013-08-31 19:50 - 00000000 ____D C:\Users\Swift\AppData\Local\ESN
2013-08-31 19:50 - 2013-08-31 19:50 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-31 19:49 - 2013-08-31 19:49 - 00000000 ____D C:\ProgramData\EA Core
2013-08-31 15:46 - 2013-08-31 16:18 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-31 03:34 - 2013-08-31 03:35 - 137524084 _____ C:\Users\Swift\Downloads\13082703.zip
2013-08-30 19:20 - 2013-09-13 20:33 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-30 19:20 - 2013-09-13 20:33 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-30 19:20 - 2013-08-31 23:57 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-30 17:05 - 2013-04-17 09:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-08-30 17:05 - 2013-04-17 08:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-08-30 15:17 - 2013-08-30 15:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-30 15:17 - 2013-08-30 15:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-30 15:17 - 2013-08-30 15:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-30 15:17 - 2013-08-30 15:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-30 15:17 - 2013-08-30 15:17 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-30 15:16 - 2013-08-30 15:16 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Macromedia
2013-08-30 15:16 - 2013-08-30 15:16 - 00000000 ____D C:\Users\Swift\AppData\Local\Macromedia
2013-08-30 15:08 - 2013-08-30 15:08 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-30 15:08 - 2013-08-30 15:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-30 15:08 - 2013-08-30 15:08 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-08-30 15:08 - 2013-08-30 15:08 - 00000000 ____D C:\Windows\system32\Macromed
2013-08-30 12:16 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-08-30 12:16 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-30 12:12 - 2013-08-30 12:12 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Adobe
2013-08-30 02:49 - 2013-08-30 02:49 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-30 02:49 - 2013-08-30 02:49 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-30 02:49 - 2013-08-30 02:49 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-30 02:49 - 2013-08-30 02:49 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-30 02:49 - 2013-08-30 02:49 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-30 02:49 - 2013-08-30 02:49 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-30 02:49 - 2013-08-30 02:49 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-30 02:49 - 2013-08-30 02:49 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-30 02:49 - 2013-08-30 02:49 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-30 02:48 - 2013-08-30 02:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-08-30 02:46 - 2013-08-30 02:53 - 00011789 _____ C:\Windows\IE10_main.log
2013-08-29 23:31 - 2013-09-01 12:50 - 00000000 ____D C:\Users\Swift\AppData\Roaming\IrfanView
2013-08-29 23:26 - 2013-08-29 23:26 - 00000000 ____D C:\Users\Swift\AppData\Roaming\ACD Systems
2013-08-29 20:47 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-29 20:47 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-29 20:47 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-29 20:47 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-29 20:47 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-29 20:47 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-29 20:47 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-29 20:47 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-29 20:47 - 2013-04-10 08:01 - 00983400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-08-29 20:47 - 2013-04-10 08:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2013-08-29 20:47 - 2012-10-09 20:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2013-08-29 20:47 - 2012-10-09 20:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2013-08-29 20:47 - 2012-10-09 19:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2013-08-29 20:47 - 2012-10-09 19:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2013-08-29 20:47 - 2011-02-03 13:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-08-29 20:46 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-29 20:46 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-29 20:46 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-29 20:46 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-29 20:46 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-29 20:46 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-29 20:46 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-29 20:46 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-29 20:46 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-08-29 20:46 - 2013-03-19 07:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-08-29 20:46 - 2013-03-19 07:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2013-08-29 20:46 - 2013-02-27 08:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2013-08-29 20:46 - 2013-02-27 07:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-08-29 20:46 - 2013-02-27 07:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2013-08-29 20:46 - 2013-02-27 06:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-08-29 20:46 - 2012-10-03 19:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2013-08-29 20:46 - 2012-10-03 19:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2013-08-29 20:46 - 2012-10-03 19:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2013-08-29 20:46 - 2012-10-03 19:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2013-08-29 20:46 - 2012-10-03 19:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2013-08-29 20:46 - 2012-10-03 19:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2013-08-29 20:46 - 2012-10-03 18:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2013-08-29 20:46 - 2012-10-03 18:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2013-08-29 20:46 - 2012-10-03 18:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2013-08-29 20:46 - 2012-10-03 18:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2013-08-29 20:46 - 2012-08-22 20:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-08-29 20:46 - 2012-08-21 23:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2013-08-29 20:46 - 2012-07-04 22:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2013-08-29 20:46 - 2012-01-13 09:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2013-08-29 20:45 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-08-29 20:45 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-08-29 20:45 - 2013-04-26 07:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-08-29 20:45 - 2013-04-26 06:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-08-29 20:45 - 2012-11-23 05:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2013-08-29 20:44 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-29 20:44 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-08-29 20:44 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-08-29 20:44 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-08-29 20:44 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-08-29 20:44 - 2013-04-26 01:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-08-29 20:44 - 2013-04-01 00:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-08-29 16:18 - 2013-09-07 02:30 - 00000000 ____D C:\Users\Swift\Desktop\m
2013-08-29 12:14 - 2013-08-29 12:14 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-29 03:01 - 2013-08-29 03:01 - 00000000 ____D C:\Windows\system32\SPReview
2013-08-29 03:01 - 2013-08-29 03:01 - 00000000 ____D C:\Windows\system32\EventProviders
2013-08-29 01:58 - 2013-08-29 01:58 - 00000000 ____D C:\Users\Swift\AppData\Local\PAYDAY 2
2013-08-29 01:58 - 2013-08-29 01:58 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-08-29 01:37 - 2010-11-20 15:27 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2013-08-29 01:37 - 2010-11-20 15:27 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-08-29 01:37 - 2010-11-20 14:19 - 00954752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40.dll
2013-08-29 01:37 - 2010-11-20 14:19 - 00954288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40u.dll
2013-08-29 01:37 - 2010-11-20 13:07 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-08-29 01:37 - 2010-11-05 03:58 - 01130824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2013-08-29 01:37 - 2010-11-05 03:57 - 01942856 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2013-08-29 01:37 - 2010-11-05 03:57 - 00048976 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll
2013-08-29 01:36 - 2010-11-20 15:39 - 05066752 _____ (Microsoft Corporation) C:\Windows\system32\AuthFWSnapin.dll
2013-08-29 01:36 - 2010-11-20 15:34 - 00295808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-08-29 01:36 - 2010-11-20 15:34 - 00215936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2013-08-29 01:36 - 2010-11-20 15:33 - 00366976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2013-08-29 01:36 - 2010-11-20 15:33 - 00299392 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2013-08-29 01:36 - 2010-11-20 15:33 - 00273792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2013-08-29 01:36 - 2010-11-20 15:29 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 14633472 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 03860992 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbon.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 03650560 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 03027968 _____ (Microsoft Corporation) C:\Windows\system32\WMVCORE.DLL
2013-08-29 01:36 - 2010-11-20 15:27 - 03008000 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 02652160 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 02543616 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 02262528 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 02086912 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 02072576 _____ (Microsoft Corporation) C:\Windows\system32\WMPEncEn.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 02055680 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 02018304 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01900544 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01808384 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01753088 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01646080 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01556992 _____ (Microsoft Corporation) C:\Windows\system32\RacEngn.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01509888 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01441280 _____ (Microsoft Corporation) C:\Windows\system32\wlanpref.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01326080 _____ (Microsoft Corporation) C:\Windows\system32\NaturalLanguage6.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01281024 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01243136 _____ (Microsoft Corporation) C:\Windows\system32\WMNetMgr.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01212416 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01197056 _____ (Microsoft Corporation) C:\Windows\system32\taskschd.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01158656 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01098240 _____ (Microsoft Corporation) C:\Windows\system32\Vault.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01082880 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01024512 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 01008128 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00933888 _____ (Microsoft Corporation) C:\Windows\system32\sqlsrv32.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00867840 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00849920 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00750080 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\odbc32.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00605696 _____ (Microsoft Corporation) C:\Windows\system32\wmpeffects.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00582656 _____ (Microsoft Corporation) C:\Windows\system32\sxs.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00577536 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\wmicmiplugin.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00481280 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\QAGENTRT.DLL
2013-08-29 01:36 - 2010-11-20 15:27 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00326144 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00299520 _____ (Microsoft Corporation) C:\Windows\system32\tsmf.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\QAGENT.DLL
2013-08-29 01:36 - 2010-11-20 15:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\spwizui.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\prncache.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll
2013-08-29 01:36 - 2010-11-20 15:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 04120064 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 03391488 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 03205120 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 02067456 _____ (Microsoft Corporation) C:\Windows\system32\d3d9.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 01866240 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 01340416 _____ (Microsoft Corporation) C:\Windows\system32\diagperf.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 01244160 _____ (Microsoft Corporation) C:\Windows\system32\imapi2fs.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00853504 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-08-29 01:36 - 2010-11-20 15:26 - 00828416 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\ipsmsnap.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2013-08-29 01:36 - 2010-11-20 15:26 - 00422912 _____ (Microsoft Corporation) C:\Windows\system32\drvstore.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00403968 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00317952 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\framedynos.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00281600 _____ (Microsoft) C:\Windows\system32\DShowRdpFilter.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\framedyn.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\hgprint.dll
2013-08-29 01:36 - 2010-11-20 15:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\dot3api.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 03957760 _____ (Microsoft Corporation) C:\Windows\system32\WinSAT.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 01975296 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 01504256 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 00897536 _____ (Microsoft Corporation) C:\Windows\system32\azroles.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 00705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2013-08-29 01:36 - 2010-11-20 15:25 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\spinstall.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 00464384 _____ (Microsoft Corporation) C:\Windows\system32\taskeng.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 00390656 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\spreview.exe
2013-08-29 01:36 - 2010-11-20 15:25 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2013-08-29 01:36 - 2010-11-20 15:25 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\schtasks.exe
2013-08-29 01:36 - 2010-11-20 15:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\FXSSVC.exe
2013-08-29 01:36 - 2010-11-20 15:24 - 00653312 _____ (Microsoft Corporation) C:\Windows\system32\lpksetup.exe
2013-08-29 01:36 - 2010-11-20 15:24 - 00345088 _____ (Microsoft Corporation) C:\Windows\system32\cmd.exe
2013-08-29 01:36 - 2010-11-20 15:24 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\lsm.exe
2013-08-29 01:36 - 2010-11-20 15:24 - 00272896 _____ (Microsoft Corporation) C:\Windows\system32\mcbuilder.exe
2013-08-29 01:36 - 2010-11-20 14:32 - 05066752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuthFWSnapin.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 01712640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 01667584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupapi.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 01363456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 01175040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 01128448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 01115136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RacEngn.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00505856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskschd.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00351232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00350208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shlwapi.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00270848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsmf.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\upnp.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00113664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll
2013-08-29 01:36 - 2010-11-20 14:21 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
2013-08-29 01:36 - 2010-11-20 14:20 - 01414144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2013-08-29 01:36 - 2010-11-20 14:20 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbc32.dll
2013-08-29 01:36 - 2010-11-20 14:20 - 00563712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2013-08-29 01:36 - 2010-11-20 14:20 - 00547840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceApi.dll
2013-08-29 01:36 - 2010-11-20 14:20 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2013-08-29 01:36 - 2010-11-20 14:20 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2013-08-29 01:36 - 2010-11-20 14:19 - 03207680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2013-08-29 01:36 - 2010-11-20 14:19 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2013-08-29 01:36 - 2010-11-20 14:19 - 02151936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2013-08-29 01:36 - 2010-11-20 14:19 - 01493504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2013-08-29 01:36 - 2010-11-20 14:19 - 00732160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2fs.dll
2013-08-29 01:36 - 2010-11-20 14:19 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2013-08-29 01:36 - 2010-11-20 14:19 - 00257024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 02522624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 01828352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d9.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 01555456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certmgr.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 01371136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 01334272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertEnroll.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 00485888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvstore.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 00252928 _____ (Microsoft) C:\Windows\SysWOW64\DShowRdpFilter.dll
2013-08-29 01:36 - 2010-11-20 14:18 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3api.dll
2013-08-29 01:36 - 2010-11-20 14:17 - 01049600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-08-29 01:36 - 2010-11-20 14:17 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2013-08-29 01:36 - 2010-11-20 14:17 - 00322048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2013-08-29 01:36 - 2010-11-20 14:17 - 00302592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
2013-08-29 01:36 - 2010-11-20 14:17 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mcbuilder.exe
2013-08-29 01:36 - 2010-11-20 13:05 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\rdpdd.dll
2013-08-29 01:36 - 2010-11-20 12:44 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\1394ohci.sys
2013-08-29 01:36 - 2010-11-20 11:27 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2013-08-29 01:36 - 2010-11-20 11:25 - 00753664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2013-08-29 01:36 - 2010-11-20 11:23 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2013-08-29 01:36 - 2010-11-20 11:21 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2013-08-29 01:36 - 2010-11-05 04:20 - 00347904 _____ C:\Windows\system32\systemsf.ebd

TattooPanda · 14.09.2013, 19:13

FRST 2

Code:

ATTFilter

2013-08-29 01:36 - 2010-11-05 03:58 - 00297808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscoree.dll
2013-08-29 01:36 - 2010-11-05 03:58 - 00049488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netfxperf.dll
2013-08-29 01:36 - 2010-11-05 03:57 - 00444752 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll
2013-08-29 01:36 - 2010-11-05 03:53 - 00320352 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe
2013-08-29 01:36 - 2010-11-05 03:53 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHost.exe
2013-08-29 01:36 - 2010-11-05 03:53 - 00109928 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll
2013-08-29 01:36 - 2010-11-05 03:53 - 00099176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHostProxy.dll
2013-08-29 01:36 - 2009-07-14 03:16 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpmonui.dll
2013-08-29 01:35 - 2010-11-20 15:44 - 01077248 _____ (Microsoft Corporation) C:\Windows\system32\Narrator.exe
2013-08-29 01:35 - 2010-11-20 15:44 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\NAPHLPR.DLL
2013-08-29 01:35 - 2010-11-20 15:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\NAPCRYPT.DLL
2013-08-29 01:35 - 2010-11-20 15:34 - 00363392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys
2013-08-29 01:35 - 2010-11-20 15:34 - 00071552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00289664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00263040 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2013-08-29 01:35 - 2010-11-20 15:33 - 00213888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00184704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00171392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scsiport.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00155008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpio.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00140672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msdsm.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00103808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sbp2port.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00094592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00078720 _____ (Hewlett-Packard Company) C:\Windows\system32\Drivers\HpSAMD.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00063360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00031104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msahci.sys
2013-08-29 01:35 - 2010-11-20 15:33 - 00014720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hwpolicy.sys
2013-08-29 01:35 - 2010-11-20 15:32 - 02217856 _____ (Microsoft Corporation) C:\Windows\system32\bootres.dll
2013-08-29 01:35 - 2010-11-20 15:32 - 00334208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2013-08-29 01:35 - 2010-11-20 15:32 - 00179072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2013-08-29 01:35 - 2010-11-20 15:28 - 00780008 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2013-08-29 01:35 - 2010-11-20 15:28 - 00298104 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2013-08-29 01:35 - 2010-11-20 15:28 - 00166784 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 02250752 _____ (Microsoft Corporation) C:\Windows\system32\SensorsCpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 02193920 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 02146816 _____ (Microsoft Corporation) C:\Windows\system32\networkmap.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 01911808 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\netcenter.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 01672704 _____ (Microsoft Corporation) C:\Windows\system32\networkexplorer.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 01363968 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 01232896 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2013-08-29 01:35 - 2010-11-20 15:27 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2013-08-29 01:35 - 2010-11-20 15:27 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 01050624 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00933376 _____ (Microsoft Corporation) C:\Windows\system32\SmiEngine.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00898560 _____ (Microsoft Corporation) C:\Windows\system32\OobeFldr.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00812032 _____ (Microsoft Corporation) C:\Windows\system32\wpccpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00799744 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00781312 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\sud.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\sdcpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00691200 _____ (Microsoft Corporation) C:\Windows\system32\VAN.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00666112 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2013-08-29 01:35 - 2010-11-20 15:27 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\PerfCenterCPL.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00636416 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmdev.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00633344 _____ (Microsoft Corporation) C:\Windows\system32\riched20.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\wiaservc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\mspbda.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\msdri.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00527872 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmnet.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\WinSATAPI.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\powercpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\wiadefui.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\nshipsec.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00451072 _____ (Microsoft Corporation) C:\Windows\system32\shwebsvc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\sqlcese30.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\spwizeng.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\termmgr.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00418816 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\prnfldr.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wlanui.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00403968 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\mtxclu.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\shsvcs.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00366080 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00358400 _____ (Microsoft Corporation) C:\Windows\system32\wmpdxm.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\sharemediacpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\srchadmin.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\raschap.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\netdiagfx.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\scansetting.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\srrstr.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00268288 _____ (Microsoft Corporation) C:\Windows\system32\MSAC3ENC.DLL
2013-08-29 01:35 - 2010-11-20 15:27 - 00264192 _____ (Microsoft Corporation) C:\Windows\system32\upnp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\wavemsp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\tcpipcfg.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\taskbarcpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\mstask.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\onex.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\scecli.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\sppcomapi.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\wmpsrcwp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\QSHVHOST.DLL
2013-08-29 01:35 - 2010-11-20 15:27 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\OnLineIDCpl.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\netiohlp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\wpdwcn.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\rasppp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\sysclass.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\syncui.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsbas.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\netjoin.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\provsvc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\twext.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\sdrsvc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\netid.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\ocsetapi.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\prntvpt.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00154624 _____ (Microsoft Corporation) C:\Windows\system32\uxlib.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\remotepg.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\recovery.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\shacct.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\wmpshell.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\ntlanman.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\srvcli.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\wiavideo.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\QSVRMGMT.DLL
2013-08-29 01:35 - 2010-11-20 15:27 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\wkssvc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\WPDShServiceObj.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\thumbcache.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\QUTIL.DLL
2013-08-29 01:35 - 2010-11-20 15:27 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\sppnp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\regapi.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\nci.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\UserAccountControlSettings.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\tlscsp.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\unimdmat.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\wkscli.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\rdpd3d.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\samcli.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ncryptui.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\RpcRtRemote.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\vss_ps.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\umb.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\rtutils.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\PrintIsolationProxy.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\msasn1.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\vpnikeapi.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\msvidc32.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\netutils.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\msyuv.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\sisbkup.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\syssetup.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\muifontsetup.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\msrle32.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2013-08-29 01:35 - 2010-11-20 15:27 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\tsbyuv.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 01457664 _____ (Microsoft Corporation) C:\Windows\system32\DxpTaskSync.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\DiagCpl.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 01066496 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00934912 _____ (Microsoft Corporation) C:\Windows\system32\FirewallControlPanel.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00861184 _____ (Microsoft Corporation) C:\Windows\system32\fontext.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\dsuiext.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00675328 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00551936 _____ (Microsoft Corporation) C:\Windows\system32\localsec.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCenter.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\imapi2.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00495104 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\DXP.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00355328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\MediaMetadataHandler.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\hgcpl.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\efscore.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\iTVData.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00279552 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dot3svc.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00240640 _____ (Microsoft Corporation) C:\Windows\system32\MFPlay.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dskquoui.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00233984 _____ (Microsoft Corporation) C:\Windows\system32\defaultlocationcpl.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\ListSvc.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingFolder.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\mprapi.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\iasrad.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\mprddm.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\logoncli.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ifsutil.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\fde.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\dps.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL
2013-08-29 01:35 - 2010-11-20 15:26 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\dwmredir.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\dnscmmc.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00116224 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\fms.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\iasacct.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\Mcx2Svc.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\hbaapi.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\dot3cfg.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\iyuv_32.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\lsmproxy.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\httpapi.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mimefilt.dll
2013-08-29 01:35 - 2010-11-20 15:26 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\iscsium.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 03745792 _____ (Microsoft Corporation) C:\Windows\system32\accessibilitycpl.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 03524608 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 01264640 _____ (Microsoft Corporation) C:\Windows\system32\sdclt.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 01065984 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00749568 _____ (Microsoft Corporation) C:\Windows\system32\batmeter.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayCpl.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00549888 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenterCPL.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00533504 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\biocpl.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00472064 _____ (Microsoft Corporation) C:\Windows\system32\azroleui.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\nltest.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00349696 _____ (Microsoft Corporation) C:\Windows\system32\slui.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00314368 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00293888 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\sethc.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00273920 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\taskmgr.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\recdisc.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00213504 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\PkgMgr.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\ocsetup.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\perfmon.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\bcdsrv.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\autoplay.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\net1.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayServices.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00128000 _____ (Microsoft) C:\Windows\system32\Robocopy.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\AxInstSv.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\nslookup.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\cca.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\cabinet.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\setupcl.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\tabcal.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\tzutil.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\runonce.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\acppage.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\cscapi.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\proquota.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\AzSqlExt.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\userinit.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2013-08-29 01:35 - 2010-11-20 15:25 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2013-08-29 01:35 - 2010-11-20 15:25 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00899584 _____ (Microsoft Corporation) C:\Windows\system32\Bubbles.scr
2013-08-29 01:35 - 2010-11-20 15:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\system32\mmsys.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00793088 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00763904 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\appwiz.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\bthprops.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\TabletPC.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00606208 _____ (Microsoft Corporation) C:\Windows\system32\dfrgui.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\main.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00477696 _____ (Microsoft Corporation) C:\Windows\system32\PhotoScreensaver.scr
2013-08-29 01:35 - 2010-11-20 15:24 - 00474112 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2013-08-29 01:35 - 2010-11-20 15:24 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2013-08-29 01:35 - 2010-11-20 15:24 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00373248 _____ (Microsoft Corporation) C:\Windows\system32\intl.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\diskraid.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\eudcedit.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00352768 _____ (Microsoft Corporation) C:\Windows\system32\sysdm.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00333824 _____ (Microsoft Corporation) C:\Windows\system32\ssText3d.scr
2013-08-29 01:35 - 2010-11-20 15:24 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\unimdm.tsp
2013-08-29 01:35 - 2010-11-20 15:24 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\msconfig.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2013-08-29 01:35 - 2010-11-20 15:24 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\Mystify.scr
2013-08-29 01:35 - 2010-11-20 15:24 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\Ribbons.scr
2013-08-29 01:35 - 2010-11-20 15:24 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\bitsadmin.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\wdmaud.drv
2013-08-29 01:35 - 2010-11-20 15:24 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\VBICodec.ax
2013-08-29 01:35 - 2010-11-20 15:24 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\bcdboot.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\powercfg.cpl
2013-08-29 01:35 - 2010-11-20 15:24 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\MdSched.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\Kswdmcap.ax
2013-08-29 01:35 - 2010-11-20 15:24 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\aitagent.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\kstvtune.ax
2013-08-29 01:35 - 2010-11-20 15:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\WSTPager.ax
2013-08-29 01:35 - 2010-11-20 15:24 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\isoburn.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\bfsvc.exe
2013-08-29 01:35 - 2010-11-20 15:24 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ksxbar.ax
2013-08-29 01:35 - 2010-11-20 15:24 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\ftp.exe
2013-08-29 01:35 - 2010-11-20 14:51 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2013-08-29 01:35 - 2010-11-20 14:36 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPHLPR.DLL
2013-08-29 01:35 - 2010-11-20 14:36 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPCRYPT.DLL
2013-08-29 01:35 - 2010-11-20 14:23 - 00144768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 02983424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbon.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 02755072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themeui.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 02202624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsCpl.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 02157568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themecpl.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 02146304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncCenter.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 01624064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPEncEn.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 01326592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanpref.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 01227776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 01003008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMNetMgr.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00933376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Vault.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00782336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00778240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlsrv32.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00755200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sud.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00738816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpmde.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00638976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VAN.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00616960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00600064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00560128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmdev.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00473600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched20.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00458752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00428544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shwebsvc.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00416768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiadefui.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00411648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlangpui.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00410624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\systemcpl.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00410112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanui.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00380416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sxs.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00372224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\termmgr.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizeng.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00352256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpeffects.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00346624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00335872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSATAPI.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00328192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsvcs.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\raschap.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00307712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srchadmin.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00299520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpdxm.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00269824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00246272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scansetting.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tapisrv.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00228352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wavemsp.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVolSSO.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00198144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdwcn.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppcomapi.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpsrcwp.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00181760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpipcfg.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasppp.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scecli.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spp.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vdsbas.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syncui.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remotepg.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twext.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00135168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsRasterService.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxlib.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shacct.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDShServiceObj.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00105472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpshell.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\thumbcache.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QUTIL.DLL
2013-08-29 01:35 - 2010-11-20 14:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserAccountControlSettings.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\regapi.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00051200 _____ (Twain Working Group) C:\Windows\twain_32.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samcli.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RpcRtRemote.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wtsapi32.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtutils.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vpnikeapi.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sisbkup.dll
2013-08-29 01:35 - 2010-11-20 14:21 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 02504192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVCORE.DLL
2013-08-29 01:35 - 2010-11-20 14:20 - 02494464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netshell.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 02130944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkmap.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 01750528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pnidui.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 01661440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkexplorer.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 01644032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcenter.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 01508864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pla.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 01111552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onexui.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00932352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printui.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00859648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OobeFldr.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00801280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NaturalLanguage6.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00656384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00600576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PerfCenterCPL.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercpl.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00395264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prnfldr.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00346112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshipsec.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00324608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\photowiz.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00225792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netdiagfx.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00218112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OnLineIDCpl.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qasf.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onex.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00190976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qcap.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netplwiz.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetapi.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QAGENT.DLL
2013-08-29 01:35 - 2010-11-20 14:20 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSHVHOST.DLL
2013-08-29 01:35 - 2010-11-20 14:20 - 00166400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiohlp.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\provsvc.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netjoin.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prntvpt.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netid.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prncache.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nci.dll
2013-08-29 01:35 - 2010-11-20 14:20 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntlanman.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00856576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallControlPanel.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00830464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2013-08-29 01:35 - 2010-11-20 14:19 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontext.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00592384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00429056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\localsec.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ipsmsnap.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00392192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxclu.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hgcpl.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00296448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprddm.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MediaMetadataHandler.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00232448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00226304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSAC3ENC.DLL
2013-08-29 01:35 - 2010-11-20 14:19 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iTVData.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-08-29 01:35 - 2010-11-20 14:19 - 00213504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MMDevAPI.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstask.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedynos.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedyn.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFPlay.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrad.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msutb.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00148992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ifsutil.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logoncli.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fde.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvfw32.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IPHLPAPI.DLL
2013-08-29 01:35 - 2010-11-20 14:19 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\migisol.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00093696 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\SysWOW64\fms.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciavi32.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasacct.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hbaapi.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdeploy.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mimefilt.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\httpapi.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msasn1.dll
2013-08-29 01:35 - 2010-11-20 14:19 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvidc32.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 03727872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\accessibilitycpl.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 01400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DxpTaskSync.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 01040384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 01003520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00854016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00762880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroles.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00744448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenter.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00743424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00740864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\batmeter.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00685056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsuiext.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuxiliaryDisplayCpl.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00630784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00537600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenterCPL.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00484864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceCenter.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00402944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00333824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3ui.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroleui.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00257024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpx.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00243712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\audiodev.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapp3hst.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00230912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapphost.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\defaultlocationcpl.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00211456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairingFolder.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiagn.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00205312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\efscore.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\activeds.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dskquoui.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adsldp.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoplay.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00132608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabview.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscmmc.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3cfg.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\acppage.dll
2013-08-29 01:35 - 2010-11-20 14:18 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2013-08-29 01:35 - 2010-11-20 14:17 - 00586752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfrgui.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimserv.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVol.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00288256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eudcedit.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00276480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskraid.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sethc.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskmgr.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PkgMgr.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00197632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetup.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskeng.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\net1.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00113152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupugc.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00098816 _____ (Microsoft) C:\Windows\SysWOW64\Robocopy.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nslookup.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logagent.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\isoburn.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\w32tm.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\runonce.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzutil.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ftp.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\proquota.exe
2013-08-29 01:35 - 2010-11-20 14:17 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userinit.exe
2013-08-29 01:35 - 2010-11-20 14:16 - 00905216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmsys.cpl
2013-08-29 01:35 - 2010-11-20 14:16 - 00776192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe
2013-08-29 01:35 - 2010-11-20 14:16 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bthprops.cpl
2013-08-29 01:35 - 2010-11-20 14:16 - 00679424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoconv.exe
2013-08-29 01:35 - 2010-11-20 14:16 - 00668160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2013-08-29 01:35 - 2010-11-20 14:16 - 00658944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autofmt.exe
2013-08-29 01:35 - 2010-11-20 14:16 - 00649216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appwiz.cpl
2013-08-29 01:35 - 2010-11-20 14:16 - 00516096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\main.cpl
2013-08-29 01:35 - 2010-11-20 14:16 - 00413696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoScreensaver.scr
2013-08-29 01:35 - 2010-11-20 14:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2013-08-29 01:35 - 2010-11-20 14:16 - 00345088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\intl.cpl
2013-08-29 01:35 - 2010-11-20 14:16 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysdm.cpl
2013-08-29 01:35 - 2010-11-20 14:16 - 00320000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2013-08-29 01:35 - 2010-11-20 14:16 - 00293888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ssText3d.scr
2013-08-29 01:35 - 2010-11-20 14:16 - 00281088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdm.tsp
2013-08-29 01:35 - 2010-11-20 14:16 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2013-08-29 01:35 - 2010-11-20 14:16 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdmaud.drv
2013-08-29 01:35 - 2010-11-20 14:16 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSTPager.ax
2013-08-29 01:35 - 2010-11-20 14:08 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2013-08-29 01:35 - 2010-11-20 14:08 - 00311296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-08-29 01:35 - 2010-11-20 13:04 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-08-29 01:35 - 2010-11-20 12:52 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndiswan.sys
2013-08-29 01:35 - 2010-11-20 12:52 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2013-08-29 01:35 - 2010-11-20 12:52 - 00111104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\raspptp.sys
2013-08-29 01:35 - 2010-11-20 12:52 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2013-08-29 01:35 - 2010-11-20 12:52 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ipfltdrv.sys
2013-08-29 01:35 - 2010-11-20 12:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2013-08-29 01:35 - 2010-11-20 12:49 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2013-08-29 01:35 - 2010-11-20 12:44 - 00184960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-08-29 01:35 - 2010-11-20 12:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\umbus.sys
2013-08-29 01:35 - 2010-11-20 12:43 - 00109696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-08-29 01:35 - 2010-11-20 12:43 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-08-29 01:35 - 2010-11-20 12:43 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winusb.sys
2013-08-29 01:35 - 2010-11-20 12:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2013-08-29 01:35 - 2010-11-20 11:26 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2013-08-29 01:35 - 2010-11-20 11:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-08-29 01:35 - 2010-11-05 04:11 - 00433512 _____ (Microsoft Corporation) C:\Windows\system32\MCEWMDRMNDBootstrap.dll
2013-08-29 01:35 - 2010-11-05 04:11 - 00312168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCEWMDRMNDBootstrap.dll
2013-08-29 01:35 - 2010-11-05 03:58 - 00155472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2013-08-29 01:35 - 2010-11-05 03:58 - 00080720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2013-08-29 01:35 - 2010-11-05 03:57 - 00154960 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 01080320 _____ (Microsoft Corporation) C:\Windows\system32\onexui.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2013-08-29 01:34 - 2010-11-20 15:27 - 00435712 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceStatus.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00431104 _____ (Microsoft Corporation) C:\Windows\system32\WPDSp.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\qdv.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceSyncProvider.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\qcap.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\mydocs.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\QCLIPROV.DLL
2013-08-29 01:34 - 2010-11-20 15:27 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\spbcd.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\napdsnap.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\vfwwdm32.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\WavDest.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\shimgvw.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\wdiasqmmodule.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\msdmo.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\shgina.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\schedcli.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\rdprefdrvapi.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\TRAPI.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\spopk.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\nrpsrv.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\wshirda.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\shunimpl.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\riched32.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\rdpcfgex.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2013-08-29 01:34 - 2010-11-20 15:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2013-08-29 01:34 - 2010-11-20 15:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\FXSTIFF.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00399872 _____ (Microsoft Corporation) C:\Windows\system32\dpx.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\dot3ui.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\iasrecst.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\EhStorAPI.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\fphc.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\dot3msm.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\KMSVC.DLL
2013-08-29 01:34 - 2010-11-20 15:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fdProxy.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\inetmib1.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\luainstall.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\FXSMON.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mciqtz32.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dsauth.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\HotStartUserAgent.dll
2013-08-29 01:34 - 2010-11-20 15:26 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\elsTrans.dll
2013-08-29 01:34 - 2010-11-20 15:25 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2013-08-29 01:34 - 2010-11-20 15:25 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2013-08-29 01:34 - 2010-11-20 15:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\amstream.dll
2013-08-29 01:34 - 2010-11-20 15:25 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\CertPolEng.dll
2013-08-29 01:34 - 2010-11-20 15:25 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\takeown.exe
2013-08-29 01:34 - 2010-11-20 15:25 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\PnPUnattend.exe
2013-08-29 01:34 - 2010-11-20 15:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\repair-bde.exe
2013-08-29 01:34 - 2010-11-20 15:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\MultiDigiMon.exe
2013-08-29 01:34 - 2010-11-20 15:25 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2013-08-29 01:34 - 2010-11-20 15:25 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\cscdll.dll
2013-08-29 01:34 - 2010-11-20 15:25 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\bitsperf.dll
2013-08-29 01:34 - 2010-11-20 15:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\BWUnpairElevated.dll
2013-08-29 01:34 - 2010-11-20 15:25 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2013-08-29 01:34 - 2010-11-20 15:25 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\C_ISCII.DLL
2013-08-29 01:34 - 2010-11-20 15:24 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\diskpart.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\iscsicli.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\desk.cpl
2013-08-29 01:34 - 2010-11-20 15:24 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\mobsync.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\cmstp.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\manage-bde.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\findstr.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\djoin.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\g711codc.ax
2013-08-29 01:34 - 2010-11-20 15:24 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\vbisurf.ax
2013-08-29 01:34 - 2010-11-20 15:24 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\choice.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\LogonUI.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\FXSUNATD.exe
2013-08-29 01:34 - 2010-11-20 15:24 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2013-08-29 01:34 - 2010-11-20 15:16 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-08-29 01:34 - 2010-11-20 15:15 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll
2013-08-29 01:34 - 2010-11-20 15:14 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwizres.dll
2013-08-29 01:34 - 2010-11-20 15:13 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\RDPENCDD.dll
2013-08-29 01:34 - 2010-11-20 15:13 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2013-08-29 01:34 - 2010-11-20 15:12 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\pifmgr.dll
2013-08-29 01:34 - 2010-11-20 15:02 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2013-08-29 01:34 - 2010-11-20 15:02 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2013-08-29 01:34 - 2010-11-20 15:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUQ.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUF.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDSG.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\kbdlk41a.dll
2013-08-29 01:34 - 2010-11-20 15:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDGKL.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDCZ1.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDSF.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDPO.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDNEPR.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTAM.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINBEN.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDGR1.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUS.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUGHR1.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTURME.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAJIK.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMON.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMAORI.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDLT1.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTEL.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINORI.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINMAR.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINKAN.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINHIN.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBULG.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBLR.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2013-08-29 01:34 - 2010-11-20 15:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDGEO.DLL
2013-08-29 01:34 - 2010-11-20 14:54 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\BlbEvents.dll
2013-08-29 01:34 - 2010-11-20 14:51 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-ums-l1-1-0.dll

TattooPanda · 14.09.2013, 19:14

FRST 3

Code:

ATTFilter

2013-08-29 01:34 - 2010-11-20 14:21 - 00902656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2013-08-29 01:34 - 2010-11-20 14:21 - 00739328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2013-08-29 01:34 - 2010-11-20 14:21 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSDECD.DLL
2013-08-29 01:34 - 2010-11-20 14:21 - 00436736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmnet.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00363008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wbemcomn.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00350720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDSp.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlcese30.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdscore.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqmapi.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpps.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00109568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiavideo.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppinst.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srvcli.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00087552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00085504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00085504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tlscsp.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spbcd.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdmat.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vfwwdm32.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpd3d.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wkscli.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimgvw.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\utildll.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsdchngr.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TRAPI.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdprefdrvapi.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shgina.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spopk.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schedcli.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syssetup.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00012288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsbyuv.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshirda.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shunimpl.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched32.dll
2013-08-29 01:34 - 2010-11-20 14:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2013-08-29 01:34 - 2010-11-20 14:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpcServices.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceStatus.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00283136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdv.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00236544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00183296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceSyncProvider.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00136192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mydocs.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00121344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSVRMGMT.DLL
2013-08-29 01:34 - 2010-11-20 14:20 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olethk32.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QCLIPROV.DLL
2013-08-29 01:34 - 2010-11-20 14:20 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\napdsnap.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptui.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netutils.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfts.dll
2013-08-29 01:34 - 2010-11-20 14:20 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprapi.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrecst.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fphc.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00082944 _____ (Radius Inc.) C:\Windows\SysWOW64\iccvid.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapistub.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapi32.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetmib1.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iyuv_32.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\luainstall.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciqtz32.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdmo.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsium.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msyuv.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lsmproxy.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\muifontsetup.dll
2013-08-29 01:34 - 2010-11-20 14:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrle32.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EhStorAPI.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3msm.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappgnui.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\avifil32.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabinet.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\amstream.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cca.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertPolEng.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscapi.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsauth.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00028160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzSqlExt.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscdll.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elsTrans.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsperf.dll
2013-08-29 01:34 - 2010-11-20 14:18 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\C_ISCII.DLL
2013-08-29 01:34 - 2010-11-20 14:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browseui.dll
2013-08-29 01:34 - 2010-11-20 14:17 - 00280064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00278016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00144896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsicli.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskpart.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00101376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mobsync.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmstp.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MuiUnattend.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00062976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\findstr.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\takeown.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unlodctr.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiougc.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2013-08-29 01:34 - 2010-11-20 14:17 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgentc.exe
2013-08-29 01:34 - 2010-11-20 14:16 - 00878592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Bubbles.scr
2013-08-29 01:34 - 2010-11-20 14:16 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Mystify.scr
2013-08-29 01:34 - 2010-11-20 14:16 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Ribbons.scr
2013-08-29 01:34 - 2010-11-20 14:16 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsadmin.exe
2013-08-29 01:34 - 2010-11-20 14:16 - 00153600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VBICodec.ax
2013-08-29 01:34 - 2010-11-20 14:16 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercfg.cpl
2013-08-29 01:34 - 2010-11-20 14:16 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\desk.cpl
2013-08-29 01:34 - 2010-11-20 14:16 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Kswdmcap.ax
2013-08-29 01:34 - 2010-11-20 14:16 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kstvtune.ax
2013-08-29 01:34 - 2010-11-20 14:16 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksxbar.ax
2013-08-29 01:34 - 2010-11-20 14:16 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\g711codc.ax
2013-08-29 01:34 - 2010-11-20 14:16 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbisurf.ax
2013-08-29 01:34 - 2010-11-20 14:08 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00119808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imm32.dll
2013-08-29 01:34 - 2010-11-20 14:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUQ.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUF.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSG.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdlk41a.dll
2013-08-29 01:34 - 2010-11-20 14:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGR1.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGKL.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDCZ1.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSF.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDPO.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDNEPR.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTAM.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINORI.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINMAR.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINKAN.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINHIN.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINBEN.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUS.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUGHR1.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTURME.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAJIK.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMON.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMAORI.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDLT1.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTEL.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGEO.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBULG.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBLR.DLL
2013-08-29 01:34 - 2010-11-20 14:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2013-08-29 01:34 - 2010-11-20 14:07 - 01164800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll
2013-08-29 01:34 - 2010-11-20 14:07 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizres.dll
2013-08-29 01:34 - 2010-11-20 14:06 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2013-08-29 01:34 - 2010-11-20 14:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pifmgr.dll
2013-08-29 01:34 - 2010-11-20 14:00 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2013-08-29 01:34 - 2010-11-20 14:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2013-08-29 01:34 - 2010-11-20 13:37 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbrpm.sys
2013-08-29 01:34 - 2010-11-20 12:52 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2013-08-29 01:34 - 2010-11-20 12:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tunnel.sys
2013-08-29 01:34 - 2010-11-20 12:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndisuio.sys
2013-08-29 01:34 - 2010-11-20 12:44 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys
2013-08-29 01:34 - 2010-11-20 12:44 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD2.sys
2013-08-29 01:34 - 2010-11-20 12:43 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2013-08-29 01:34 - 2010-11-20 12:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2013-08-29 01:34 - 2010-11-20 12:34 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_sd.sys
2013-08-29 01:34 - 2010-11-20 12:33 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\CompositeBus.sys
2013-08-29 01:34 - 2010-11-20 12:33 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2013-08-29 01:34 - 2010-11-20 12:14 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2013-08-29 01:34 - 2010-11-20 12:09 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scfilter.sys
2013-08-29 01:34 - 2010-11-20 12:04 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2013-08-29 01:34 - 2010-11-20 11:30 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpipmi.sys
2013-08-29 01:34 - 2010-11-20 11:26 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2013-08-29 01:34 - 2010-11-20 11:22 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdi.sys
2013-08-29 01:34 - 2010-11-20 11:19 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdrom.sys
2013-08-29 01:34 - 2010-11-10 03:48 - 00010429 _____ C:\Windows\system32\ScavengeSpace.xml
2013-08-29 01:34 - 2010-11-05 04:20 - 00105559 _____ C:\Windows\SysWOW64\RacRules.xml
2013-08-29 01:34 - 2010-11-05 04:20 - 00105559 _____ C:\Windows\system32\RacRules.xml
2013-08-29 01:34 - 2009-06-10 23:39 - 00001041 _____ C:\Windows\SysWOW64\tcpbidi.xml
2013-08-29 01:33 - 2010-11-20 15:27 - 00529408 _____ (Microsoft Corporation) C:\Windows\system32\wbemcomn.dll
2013-08-29 01:33 - 2010-11-20 15:27 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\sqmapi.dll
2013-08-28 20:43 - 2013-08-31 19:48 - 00000000 ____D C:\Users\Swift\AppData\Local\Origin
2013-08-28 20:43 - 2013-08-29 15:11 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Origin
2013-08-28 20:31 - 2013-08-31 19:49 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-28 20:31 - 2013-08-29 15:11 - 00000000 ____D C:\ProgramData\Origin
2013-08-28 18:24 - 2013-08-29 18:58 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 18:23 - 2013-08-29 23:26 - 00000000 ____D C:\Users\Swift\AppData\Local\ACD Systems
2013-08-28 18:22 - 2013-08-28 18:22 - 00000000 ____D C:\Users\Swift\AppData\Roaming\TV Movie
2013-08-28 18:18 - 2013-08-28 18:21 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:13 - 2013-08-28 18:13 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Malwarebytes
2013-08-28 18:13 - 2013-08-28 18:13 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 18:13 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-28 18:12 - 2013-08-28 18:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 18:03 - 2013-08-28 18:03 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TV Movie
2013-08-28 18:02 - 2013-08-28 18:02 - 00000000 ____D C:\Windows\Downloaded Installations
2013-08-28 18:02 - 2013-08-28 18:02 - 00000000 ____D C:\Program Files (x86)\TV Movie
2013-08-28 17:53 - 2013-08-28 17:53 - 00000000 ____D C:\ProgramData\ACD Systems
2013-08-28 17:36 - 2013-09-04 13:44 - 00000248 _____ C:\Windows\Lexstat.ini
2013-08-28 17:36 - 2013-08-28 17:36 - 00000000 ____D C:\Program Files\Lexmark X1100 Series
2013-08-28 17:34 - 2013-08-28 17:37 - 00014750 _____ C:\Windows\system32\LexFiles.ulf
2013-08-28 17:34 - 2013-08-28 17:37 - 00000000 ____D C:\Program Files (x86)\Lexmark X1100 Series
2013-08-28 17:34 - 2008-02-19 09:12 - 00565928 _____ ( ) C:\Windows\system32\lxbkcoms.exe
2013-08-28 17:34 - 2008-02-19 09:12 - 00537256 _____ ( ) C:\Windows\SysWOW64\lxbkcoms.exe
2013-08-28 17:34 - 2008-02-19 09:12 - 00385704 _____ ( ) C:\Windows\SysWOW64\lxbkih.exe
2013-08-28 17:34 - 2008-02-19 09:12 - 00381608 _____ ( ) C:\Windows\SysWOW64\lxbkcfg.exe
2013-08-28 17:34 - 2008-02-19 09:12 - 00235688 _____ ( ) C:\Windows\system32\lxbkcfg.exe
2013-08-28 17:34 - 2008-02-19 09:12 - 00233128 _____ ( ) C:\Windows\system32\lxbkih.exe
2013-08-28 17:34 - 2008-02-19 09:12 - 00180904 _____ ( ) C:\Windows\SysWOW64\lxbkppls.exe
2013-08-28 17:34 - 2008-02-19 09:04 - 00001525 _____ C:\Windows\SysWOW64\lxbk.loc
2013-08-28 17:34 - 2008-02-19 09:04 - 00001525 _____ C:\Windows\system32\lxbk.loc
2013-08-28 17:34 - 2006-12-14 10:47 - 00077824 _____ (Lexmark International, Inc.) C:\Windows\system32\lxbkinsr.dll
2013-08-28 17:34 - 2006-12-14 10:45 - 00444928 _____ (Lexmark International Inc.) C:\Windows\system32\lxbkjswr.dll
2013-08-28 17:34 - 2006-12-14 10:45 - 00078848 _____ (Lexmark International Inc.) C:\Windows\system32\lxbkcur.dll
2013-08-28 17:34 - 2006-12-14 08:18 - 00094208 _____ (Lexmark International, Inc.) C:\Windows\SysWOW64\lxbkinsr.dll
2013-08-28 17:34 - 2006-12-14 08:17 - 00462848 _____ (Lexmark International Inc.) C:\Windows\SysWOW64\lxbkjswr.dll
2013-08-28 17:34 - 2006-12-14 08:17 - 00094208 _____ (Lexmark International Inc.) C:\Windows\SysWOW64\lxbkcur.dll
2013-08-28 17:34 - 2006-11-30 15:47 - 00177664 _____ (Lexmark International, Inc.) C:\Windows\system32\lxbkins.dll
2013-08-28 17:34 - 2006-11-30 15:47 - 00135168 _____ (Lexmark International Inc.) C:\Windows\system32\lxbkinsb.dll
2013-08-28 17:34 - 2006-11-30 15:45 - 00567808 _____ C:\Windows\system32\lxbkutil.dll
2013-08-28 17:34 - 2006-11-30 15:45 - 00079360 _____ (Lexmark International Inc.) C:\Windows\system32\lxbkcu.dll
2013-08-28 17:34 - 2006-11-30 13:35 - 00155648 _____ (Lexmark International Inc.) C:\Windows\SysWOW64\lxbkinsb.dll
2013-08-28 17:34 - 2006-11-30 13:35 - 00131072 _____ (Lexmark International, Inc.) C:\Windows\SysWOW64\lxbkins.dll
2013-08-28 17:34 - 2006-11-30 13:34 - 00413696 _____ C:\Windows\SysWOW64\lxbkutil.dll
2013-08-28 17:34 - 2006-11-30 13:34 - 00073728 _____ (Lexmark International Inc.) C:\Windows\SysWOW64\lxbkcu.dll
2013-08-28 17:34 - 2006-11-09 20:29 - 00062464 _____ (Lexmark International) C:\Windows\system32\LXBKcfg.dll
2013-08-28 17:34 - 2006-11-09 20:28 - 00073728 _____ (Lexmark International) C:\Windows\SysWOW64\LXBKcfg.dll
2013-08-28 17:34 - 2006-11-06 17:56 - 00409600 _____ ( ) C:\Windows\system32\lxbkpmui.dll
2013-08-28 17:34 - 2006-11-06 17:53 - 01417728 _____ ( ) C:\Windows\system32\lxbkserv.dll
2013-08-28 17:34 - 2006-11-06 17:38 - 00249856 _____ ( ) C:\Windows\system32\lxbkcomm.dll
2013-08-28 17:34 - 2006-11-06 17:34 - 00487424 _____ ( ) C:\Windows\system32\lxbklmpm.dll
2013-08-28 17:34 - 2006-11-06 17:32 - 00194048 _____ C:\Windows\system32\LXBKinst.dll
2013-08-28 17:34 - 2006-11-06 17:31 - 00226816 _____ ( ) C:\Windows\system32\lxbkiesc.dll
2013-08-28 17:34 - 2006-11-06 17:27 - 00010752 _____ ( ) C:\Windows\system32\lxbkpplc.dll
2013-08-28 17:34 - 2006-11-06 17:25 - 00695808 _____ ( ) C:\Windows\system32\lxbkcomc.dll
2013-08-28 17:34 - 2006-11-06 17:24 - 00035328 _____ ( ) C:\Windows\system32\lxbkprox.dll
2013-08-28 17:34 - 2006-11-06 17:14 - 00238592 _____ ( ) C:\Windows\system32\lxbkinpa.dll
2013-08-28 17:34 - 2006-11-06 17:12 - 01099264 _____ ( ) C:\Windows\system32\lxbkusb1.dll
2013-08-28 17:34 - 2006-11-06 17:05 - 00305152 _____ ( ) C:\Windows\system32\LXBKhcp.dll
2013-08-28 17:34 - 2006-11-06 17:03 - 00659456 _____ ( ) C:\Windows\system32\lxbkhbn3.dll
2013-08-28 17:34 - 2006-11-06 16:37 - 00643072 _____ ( ) C:\Windows\SysWOW64\lxbkpmui.dll
2013-08-28 17:34 - 2006-11-06 16:35 - 01224704 _____ ( ) C:\Windows\SysWOW64\lxbkserv.dll
2013-08-28 17:34 - 2006-11-06 16:28 - 00421888 _____ ( ) C:\Windows\SysWOW64\lxbkcomm.dll
2013-08-28 17:34 - 2006-11-06 16:26 - 00585728 _____ ( ) C:\Windows\SysWOW64\lxbklmpm.dll
2013-08-28 17:34 - 2006-11-06 16:25 - 00274432 _____ C:\Windows\SysWOW64\LXBKinst.dll
2013-08-28 17:34 - 2006-11-06 16:24 - 00397312 _____ ( ) C:\Windows\SysWOW64\lxbkiesc.dll
2013-08-28 17:34 - 2006-11-06 16:21 - 00094208 _____ ( ) C:\Windows\SysWOW64\lxbkpplc.dll
2013-08-28 17:34 - 2006-11-06 16:20 - 00684032 _____ ( ) C:\Windows\SysWOW64\lxbkcomc.dll
2013-08-28 17:34 - 2006-11-06 16:20 - 00163840 _____ ( ) C:\Windows\SysWOW64\lxbkprox.dll
2013-08-28 17:34 - 2006-11-06 16:12 - 00413696 _____ ( ) C:\Windows\SysWOW64\lxbkinpa.dll
2013-08-28 17:34 - 2006-11-06 16:11 - 00991232 _____ ( ) C:\Windows\SysWOW64\lxbkusb1.dll
2013-08-28 17:34 - 2006-11-06 16:07 - 00696320 _____ ( ) C:\Windows\SysWOW64\lxbkhbn3.dll
2013-08-28 17:34 - 2006-09-18 11:23 - 00983101 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lxbkgf.dll
2013-08-28 15:32 - 2013-08-29 18:56 - 00000000 ____D C:\Windows\erdnt
2013-08-28 13:35 - 2013-08-28 13:35 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-08-28 03:51 - 2013-09-04 00:52 - 00000000 ____D C:\ProgramData\AVerTV 3D
2013-08-28 03:49 - 2013-08-28 03:49 - 00000000 ____D C:\Windows\Driver Cache
2013-08-28 03:49 - 2013-08-28 03:49 - 00000000 ____D C:\Users\Swift\AppData\Local\AVerMedia
2013-08-28 03:49 - 2012-11-29 08:03 - 00804736 _____ (AVerMedia TECHNOLOGIES, Inc.) C:\Windows\system32\Drivers\AVerAF35.sys
2013-08-28 03:42 - 2012-08-31 23:07 - 00110592 _____ (AVerMedia Technologies, Inc.) C:\Windows\SysWOW64\CardID.dll
2013-08-28 03:42 - 2007-02-08 21:09 - 00049152 _____ () C:\Windows\SysWOW64\AVerIO.dll
2013-08-28 03:42 - 2005-04-29 03:08 - 00003456 _____ C:\Windows\SysWOW64\AVerIO.sys
2013-08-28 03:41 - 2012-10-23 21:14 - 00622592 _____ C:\Windows\SysWOW64\sptlib21.dll
2013-08-28 03:41 - 2011-07-28 23:42 - 00307200 _____ C:\Windows\SysWOW64\sptlib22.dll
2013-08-28 03:41 - 2011-06-01 19:55 - 00421888 _____ C:\Windows\SysWOW64\sptlib02.dll
2013-08-28 03:41 - 2010-06-24 22:10 - 00311296 _____ C:\Windows\SysWOW64\sptlib01.dll
2013-08-28 03:41 - 2010-06-24 22:10 - 00307200 _____ C:\Windows\SysWOW64\sptlib03.dll
2013-08-28 03:41 - 2009-09-04 23:47 - 00135168 _____ C:\Windows\SysWOW64\sptlib12.dll
2013-08-28 03:41 - 2009-07-03 03:38 - 00294912 _____ C:\Windows\SysWOW64\sptlib11.dll
2013-08-28 03:40 - 2013-08-28 03:49 - 00000000 ____D C:\Program Files (x86)\AVerMedia
2013-08-28 03:38 - 2011-03-25 05:29 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-08-28 03:38 - 2011-03-25 05:29 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-08-28 03:38 - 2011-03-25 05:29 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-08-28 03:38 - 2011-03-25 05:29 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-08-28 03:38 - 2011-03-25 05:29 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-08-28 03:38 - 2011-03-25 05:29 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-08-28 03:38 - 2011-03-25 05:28 - 00007936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-08-28 03:38 - 2011-03-11 08:41 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2013-08-28 03:38 - 2011-03-11 08:41 - 00189824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2013-08-28 03:38 - 2011-03-11 08:41 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2013-08-28 03:38 - 2011-03-11 08:41 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2013-08-28 03:38 - 2011-03-11 08:41 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2013-08-28 03:38 - 2011-03-11 08:41 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2013-08-28 03:38 - 2011-03-11 08:33 - 02565632 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2013-08-28 03:38 - 2011-03-11 08:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2013-08-28 03:38 - 2011-03-11 07:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2013-08-28 03:38 - 2011-03-11 07:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
2013-08-28 03:38 - 2011-03-11 06:37 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2013-08-28 00:57 - 2013-08-28 00:57 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Mozilla
2013-08-28 00:55 - 2013-08-28 00:55 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 00:55 - 2013-08-28 00:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Swift\AppData\Local\Mozilla
2013-08-27 23:52 - 2013-08-28 00:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-27 23:26 - 2013-08-27 23:51 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-08-27 23:26 - 2013-04-09 15:13 - 00110264 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2013-08-27 23:26 - 2012-05-05 11:54 - 00662288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2013-08-27 23:26 - 2012-05-05 11:54 - 00137000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2013-08-27 23:26 - 2012-05-05 11:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2013-08-27 23:26 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2013-08-27 23:26 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2013-08-27 23:26 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\Users\Swift\AppData\Roaming\OpenOffice
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Jasc Software Inc
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\ProgramData\InstallShield
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\Program Files (x86)\Jasc Software Inc
2013-08-27 22:54 - 2013-09-02 00:47 - 00000000 ____D C:\Program Files\CCleaner
2013-08-27 22:54 - 2013-08-27 22:54 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-27 22:51 - 2013-08-27 22:51 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2013-08-27 22:50 - 2013-09-03 15:18 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-08-27 22:50 - 2013-09-03 15:17 - 00000000 ____D C:\Users\Swift\AppData\Roaming\DVDVideoSoft
2013-08-27 22:48 - 2013-08-27 22:48 - 00000000 ____D C:\Program Files\VideoLAN
2013-08-27 22:41 - 2013-08-27 22:41 - 00000000 ____D C:\Users\Swift\AppData\Local\Logitech
2013-08-27 22:41 - 2013-08-27 22:41 - 00000000 ____D C:\ProgramData\LogiShrd
2013-08-27 22:40 - 2013-08-27 22:40 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2013-08-27 22:40 - 2013-08-27 22:40 - 00000776 _____ C:\Windows\LkmdfCoInst.log
2013-08-27 22:40 - 2013-08-27 22:40 - 00000000 ____D C:\Program Files\Logitech Gaming Software
2013-08-27 22:39 - 2013-08-27 22:39 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Logitech
2013-08-27 22:39 - 2013-08-27 22:39 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Logishrd
2013-08-27 22:10 - 2013-08-27 22:10 - 00000000 ____D C:\ProgramData\eBay
2013-08-27 22:10 - 2013-08-27 22:10 - 00000000 ____D C:\Program Files (x86)\eBay
2013-08-27 22:08 - 2013-08-27 22:08 - 00000000 ____D C:\Users\Swift\Documents\KARTEN
2013-08-27 22:07 - 2013-09-12 16:34 - 00000000 ____D C:\Users\Swift\Documents\Eigene PSP-Dateien
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\yourp
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA3 User Files
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA Vice City User Files
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA San Andreas User Files
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GHOSTBUSTERS (tm)
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Dust
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\DOTC
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Carax 95
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Bully Scholarship Edition
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Buch
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Battlefield 2
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Activision
2013-08-27 22:07 - 2013-07-26 01:09 - 00308037 _____ C:\Users\Swift\Documents\berwachungsstaat_f_r_Dummies_PRISM_-_Jeder_ist_im_Fadenkreuz.wmv
2013-08-27 22:07 - 2013-01-15 16:59 - 00026695 _____ C:\Users\Swift\Documents\spraylogos.rar
2013-08-27 22:07 - 2012-09-20 16:32 - 00017512 _____ C:\Users\Swift\Documents\Ohne Titel.veg.bak
2013-08-27 22:07 - 2010-10-31 14:53 - 00001903 _____ C:\Users\Swift\Documents\sms.csv
2013-08-27 22:07 - 2010-10-31 14:51 - 00002226 _____ C:\Users\Swift\Documents\test.csv
2013-08-27 22:07 - 2008-01-13 02:07 - 00002062 _____ C:\Users\Swift\Documents\schweigeminute.txt
2013-08-27 22:07 - 2006-12-21 18:02 - 00708015 _____ C:\Users\Swift\Documents\kruemelzwerg.imb
2013-08-27 22:07 - 2006-12-21 18:02 - 00682198 _____ C:\Users\Swift\Documents\kruemelzwerg.tlb
2013-08-27 22:07 - 2005-10-31 21:59 - 00120026 _____ C:\Users\Swift\Documents\kruemelzwerg.tla
2013-08-27 22:07 - 2004-03-30 18:24 - 00337981 _____ C:\Users\Swift\Documents\CoN_flashintro.swf
2013-08-27 22:07 - 2002-08-31 15:30 - 00009869 _____ C:\Users\Swift\Documents\eier.htm
2013-08-27 22:07 - 2002-02-05 03:12 - 00236576 _____ C:\Users\Swift\Documents\Hör mal wer da hämmert (Home Improvement).htm
2013-08-27 22:06 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Turbo Lister Backup
2013-08-27 22:06 - 2013-08-27 22:06 - 00000000 ____D C:\Users\Swift\Documents\Turbo Lister
2013-08-27 22:06 - 2013-08-27 22:06 - 00000000 ____D C:\Users\Swift\Documents\Telltale Games
2013-08-27 22:05 - 2013-09-09 19:00 - 00000000 ____D C:\Users\Swift\Documents\My Games
2013-08-27 22:05 - 2013-08-27 22:05 - 00000000 ____D C:\ProgramData\Codemasters
2013-08-27 22:04 - 2013-09-09 18:54 - 00466456 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2013-08-27 22:04 - 2013-09-09 18:54 - 00444952 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2013-08-27 22:04 - 2013-09-09 18:54 - 00122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2013-08-27 22:04 - 2013-09-09 18:54 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2013-08-27 22:04 - 2013-09-09 18:54 - 00000000 ____D C:\Program Files (x86)\OpenAL
2013-08-27 22:04 - 2013-08-27 22:04 - 00000000 ____D C:\Program Files (x86)\BRS
2013-08-27 22:04 - 2011-09-05 20:57 - 01306624 _____ (Blue Ripple Sound Limited) C:\Windows\SysWOW64\rapture3d_oal.dll
2013-08-27 22:04 - 2010-09-22 14:12 - 19087360 _____ (Intel Corporation / Blue Ripple Sound Limited) C:\Windows\SysWOW64\mkl_blueripple.dll
2013-08-27 21:59 - 2013-09-14 12:53 - 00000000 ___RD C:\Users\Swift\Desktop\Items
2013-08-27 21:58 - 2013-09-09 18:10 - 00000000 ___RD C:\Users\Swift\Desktop\Games
2013-08-27 21:45 - 2013-08-27 21:45 - 00000000 ____D C:\Users\Swift\AppData\Local\Criterion Games
2013-08-27 21:42 - 2013-08-27 21:42 - 00000000 ____D C:\Program Files (x86)\MozBackup
2013-08-27 21:41 - 2013-09-01 19:45 - 00000000 ____D C:\Users\Swift\AppData\Roaming\NVIDIA
2013-08-27 21:41 - 2013-08-27 21:41 - 00002090 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-08-27 21:41 - 2013-08-27 21:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-27 21:38 - 2013-09-14 03:42 - 00000000 ____D C:\Users\Swift\AppData\Roaming\TS3Client
2013-08-27 20:28 - 2013-08-27 20:28 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Thunderbird
2013-08-27 20:28 - 2013-08-27 20:28 - 00000000 ____D C:\Users\Swift\AppData\Local\Thunderbird
2013-08-27 20:27 - 2013-08-27 20:27 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-27 19:23 - 2013-08-27 19:23 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-27 19:20 - 2013-09-04 13:40 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Foxit Software
2013-08-27 19:20 - 2013-08-27 19:20 - 00000000 ____D C:\Program Files (x86)\Foxit Software
2013-08-27 19:20 - 2013-06-09 21:59 - 00216064 _____ C:\Windows\SysWOW64\gcapi_dll.dll
2013-08-27 19:19 - 2013-09-09 21:28 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-08-27 19:19 - 2013-08-27 19:19 - 00000967 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-08-27 19:19 - 2013-08-27 19:19 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-08-27 19:18 - 2013-08-27 19:18 - 00000000 ____D C:\Users\Swift\Desktop\mp3
2013-08-27 19:17 - 2013-08-27 19:17 - 00000400 _____ C:\Windows\ODBC.INI
2013-08-27 19:16 - 2013-08-27 19:16 - 00000000 ____D C:\Windows\PCHEALTH
2013-08-27 19:16 - 2013-08-27 19:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-08-27 19:13 - 2013-08-27 19:13 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-08-27 19:13 - 2013-08-27 19:13 - 00000000 ____D C:\Users\Swift\AppData\Roaming\DAEMON Tools Lite
2013-08-27 19:13 - 2013-08-27 19:13 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-08-27 19:12 - 2013-08-27 19:13 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-08-27 12:14 - 2013-09-09 18:51 - 00115450 _____ C:\Windows\DirectX.log
2013-08-27 12:14 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2013-08-27 12:14 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2013-08-27 12:14 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2013-08-27 12:14 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2013-08-27 12:14 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2013-08-27 12:14 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2013-08-27 12:14 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2013-08-27 12:14 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2013-08-27 12:14 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2013-08-27 12:14 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2013-08-27 12:14 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2013-08-27 12:14 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2013-08-27 12:14 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2013-08-27 12:14 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2013-08-27 12:14 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2013-08-27 12:14 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2013-08-27 12:14 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2013-08-27 12:14 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2013-08-27 12:14 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2013-08-27 12:14 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2013-08-27 12:14 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2013-08-27 12:14 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2013-08-27 12:14 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2013-08-27 12:14 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2013-08-27 12:14 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2013-08-27 12:14 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2013-08-27 12:14 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2013-08-27 12:14 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2013-08-27 12:14 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2013-08-27 12:14 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2013-08-27 12:14 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2013-08-27 12:14 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2013-08-27 12:14 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2013-08-27 12:14 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2013-08-27 12:14 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2013-08-27 12:14 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2013-08-27 12:14 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2013-08-27 12:14 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2013-08-27 12:14 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2013-08-27 12:14 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2013-08-27 12:14 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2013-08-27 12:14 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2013-08-27 12:14 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2013-08-27 12:14 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2013-08-27 12:14 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2013-08-27 12:14 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2013-08-27 12:14 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2013-08-27 12:14 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2013-08-27 12:14 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2013-08-27 12:14 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2013-08-27 12:14 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2013-08-27 12:14 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2013-08-27 12:14 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2013-08-27 12:14 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2013-08-27 12:14 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2013-08-27 12:14 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2013-08-27 12:14 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2013-08-27 12:14 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2013-08-27 12:14 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2013-08-27 12:14 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2013-08-27 12:14 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2013-08-27 12:14 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2013-08-27 12:14 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2013-08-27 12:14 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2013-08-27 12:14 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2013-08-27 12:14 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2013-08-27 12:14 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2013-08-27 12:14 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2013-08-27 12:14 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2013-08-27 12:14 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2013-08-27 12:14 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2013-08-27 12:14 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2013-08-27 12:14 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2013-08-27 12:14 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2013-08-27 12:14 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2013-08-27 12:14 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2013-08-27 12:14 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2013-08-27 12:14 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2013-08-27 12:14 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2013-08-27 12:14 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2013-08-27 12:14 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2013-08-27 12:14 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2013-08-27 12:14 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2013-08-27 12:14 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2013-08-27 12:14 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2013-08-27 12:14 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2013-08-27 12:14 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2013-08-27 12:14 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2013-08-27 12:14 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2013-08-27 12:14 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2013-08-27 12:14 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2013-08-27 12:14 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2013-08-27 12:14 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2013-08-27 12:14 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2013-08-27 12:14 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2013-08-27 12:14 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2013-08-27 12:14 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2013-08-27 12:14 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2013-08-27 12:14 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2013-08-27 12:14 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2013-08-27 12:14 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2013-08-27 12:14 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2013-08-27 12:14 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2013-08-27 12:14 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2013-08-27 12:14 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2013-08-27 12:14 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2013-08-27 12:14 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2013-08-27 12:14 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2013-08-27 12:14 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2013-08-27 12:14 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2013-08-27 12:14 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2013-08-27 12:14 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2013-08-27 12:14 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2013-08-27 12:14 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2013-08-27 12:14 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2013-08-27 12:14 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2013-08-27 12:14 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2013-08-27 12:14 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2013-08-27 12:14 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2013-08-27 12:14 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2013-08-27 12:14 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2013-08-27 12:14 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2013-08-27 12:14 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2013-08-27 12:14 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2013-08-27 12:14 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2013-08-27 12:14 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2013-08-27 12:14 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2013-08-27 12:14 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2013-08-27 12:14 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2013-08-27 12:14 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2013-08-27 12:14 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2013-08-27 12:14 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2013-08-27 12:14 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2013-08-27 12:14 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2013-08-27 12:14 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2013-08-27 12:14 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2013-08-27 12:14 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2013-08-27 12:14 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2013-08-27 12:14 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2013-08-27 12:14 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2013-08-27 12:14 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2013-08-27 12:14 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2013-08-27 12:14 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2013-08-27 12:14 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2013-08-27 12:14 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2013-08-27 12:14 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2013-08-27 12:14 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2013-08-27 12:14 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2013-08-27 12:14 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2013-08-27 12:14 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2013-08-27 10:28 - 2013-08-27 10:28 - 00000000 ____D C:\NvidiaLogging
2013-08-27 10:27 - 2013-08-27 10:27 - 00000000 ____D C:\Users\Swift\AppData\Local\NVIDIA
2013-08-27 10:27 - 2013-08-20 15:32 - 00029984 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-08-27 09:06 - 2013-09-14 13:02 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Skype
2013-08-27 09:06 - 2013-08-27 09:06 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-27 09:06 - 2013-08-27 09:06 - 00000000 ____D C:\ProgramData\Skype
2013-08-27 08:15 - 2013-08-30 15:17 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-27 08:15 - 2013-08-30 15:17 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-27 08:15 - 2013-08-27 08:15 - 00000000 ____D C:\ProgramData\Sun
2013-08-27 07:41 - 2013-08-27 07:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2013-08-27 07:38 - 2013-09-13 18:12 - 00011744 _____ C:\Windows\PFRO.log
2013-08-27 07:23 - 2013-08-28 13:23 - 00000000 ____D C:\Users\Swift\AppData\Roaming\WinRAR
2013-08-27 07:23 - 2013-08-27 20:24 - 00000000 ____D C:\Program Files\WinRAR
2013-08-27 07:21 - 2013-09-12 13:13 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-27 07:21 - 2013-08-29 15:10 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-27 07:21 - 2013-08-27 07:21 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-08-27 07:21 - 2013-08-27 07:21 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-08-27 07:21 - 2013-08-27 07:21 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-08-27 07:21 - 2013-08-27 07:21 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-08-27 07:21 - 2013-08-27 07:21 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-08-27 07:21 - 2013-08-27 07:21 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-08-27 07:21 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-08-27 07:21 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-08-27 07:21 - 2013-05-09 10:59 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-08-27 07:21 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-08-27 07:21 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-08-27 07:21 - 2013-05-09 10:58 - 00287840 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-08-27 07:20 - 2013-08-27 07:20 - 00000000 ____D C:\Program Files\AVAST Software
2013-08-27 07:20 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-08-27 07:18 - 2013-08-27 07:20 - 00000000 ____D C:\ProgramData\AVAST Software
2013-08-27 07:16 - 2013-09-14 14:24 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-27 07:16 - 2013-09-14 03:21 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-27 07:16 - 2013-09-04 13:23 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-27 07:16 - 2013-08-30 02:35 - 00000000 ____D C:\Users\Swift\AppData\Local\Google
2013-08-27 07:16 - 2013-08-30 02:35 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-27 07:16 - 2013-08-27 07:16 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-08-27 07:16 - 2013-08-27 07:16 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-08-27 07:15 - 2013-08-29 23:26 - 00068328 _____ C:\Users\Swift\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-27 07:15 - 2013-08-27 07:16 - 00000000 ____D C:\Users\Swift\AppData\Local\Deployment
2013-08-27 07:15 - 2013-08-27 07:15 - 00000000 ____D C:\Users\Swift\AppData\Local\Apps\2.0
2013-08-27 07:14 - 2013-08-27 07:14 - 00003536 _____ C:\Windows\System32\Tasks\CreateChoiceProcessTask
2013-08-27 06:32 - 2012-07-26 06:55 - 00785512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-08-27 06:32 - 2012-07-26 06:55 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-08-27 06:32 - 2012-07-26 04:36 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-08-27 06:32 - 2012-06-02 16:35 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2013-08-27 06:22 - 2010-02-23 10:16 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\browserchoice.exe
2013-08-27 06:20 - 2013-09-11 17:28 - 00000000 ____D C:\Windows\system32\MRT
2013-08-27 06:20 - 2013-09-11 17:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-27 06:18 - 2013-08-27 06:20 - 00004747 _____ C:\Windows\IE9_main.log
2013-08-27 06:11 - 2013-08-27 06:12 - 00035545 _____ C:\Windows\Ascd_tmp.ini
2013-08-27 06:05 - 2013-08-27 05:11 - 00000000 ____D C:\Windows\Panther
2013-08-27 06:05 - 2012-12-16 19:11 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-08-27 06:05 - 2012-12-16 16:45 - 00367616 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-08-27 06:05 - 2012-12-16 16:13 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-08-27 06:05 - 2012-12-16 16:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-08-27 06:05 - 2010-09-30 12:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-08-27 06:05 - 2010-09-30 08:47 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-08-27 06:04 - 2012-07-26 05:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2013-08-27 06:04 - 2012-07-26 05:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2013-08-27 06:04 - 2012-07-26 05:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2013-08-27 06:04 - 2012-07-26 05:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2013-08-27 06:04 - 2012-07-26 05:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2013-08-27 06:04 - 2012-07-26 04:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2013-08-27 06:04 - 2012-07-26 04:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2013-08-27 06:04 - 2012-06-02 16:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2013-08-27 05:54 - 2012-03-01 08:46 - 00023408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2013-08-27 05:54 - 2012-03-01 08:33 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-08-27 05:54 - 2012-03-01 08:28 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2013-08-27 05:54 - 2012-03-01 07:33 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-08-27 05:54 - 2012-03-01 07:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
2013-08-27 05:49 - 2011-04-09 08:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2013-08-27 05:49 - 2011-04-09 07:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2013-08-27 05:48 - 2013-02-15 08:08 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-27 05:48 - 2013-02-15 08:06 - 03717632 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-27 05:48 - 2013-02-15 08:02 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-27 05:48 - 2013-02-15 06:37 - 03217408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-27 05:48 - 2013-02-15 06:34 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-27 05:48 - 2013-02-15 05:25 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-27 05:48 - 2012-12-07 15:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2013-08-27 05:48 - 2012-12-07 15:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2013-08-27 05:48 - 2012-12-07 14:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2013-08-27 05:48 - 2012-12-07 14:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2013-08-27 05:48 - 2012-12-07 13:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2013-08-27 05:48 - 2012-12-07 13:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2013-08-27 05:48 - 2012-12-07 13:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2013-08-27 05:48 - 2012-12-07 13:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2013-08-27 05:48 - 2012-12-07 13:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2013-08-27 05:48 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2013-08-27 05:48 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2013-08-27 05:48 - 2012-12-07 13:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2013-08-27 05:48 - 2012-12-07 13:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2013-08-27 05:48 - 2012-12-07 13:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2013-08-27 05:48 - 2012-12-07 13:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2013-08-27 05:48 - 2012-12-07 13:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2013-08-27 05:48 - 2012-12-07 13:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2013-08-27 05:48 - 2012-12-07 13:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2013-08-27 05:48 - 2012-12-07 12:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2013-08-27 05:48 - 2012-09-26 00:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2013-08-27 05:48 - 2012-09-26 00:46 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2013-08-27 05:48 - 2012-01-04 12:44 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2013-08-27 05:48 - 2012-01-04 10:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2013-08-27 05:48 - 2011-10-26 07:25 - 01572864 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2013-08-27 05:48 - 2011-10-26 07:25 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-08-27 05:48 - 2011-10-26 06:32 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2013-08-27 05:48 - 2011-10-26 06:32 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-08-27 05:48 - 2011-06-15 12:02 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\odbctrac.dll
2013-08-27 05:48 - 2011-06-15 12:02 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2013-08-27 05:48 - 2011-06-15 12:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccu32.dll
2013-08-27 05:48 - 2011-06-15 12:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccr32.dll
2013-08-27 05:48 - 2011-06-15 10:55 - 00319488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcjt32.dll
2013-08-27 05:48 - 2011-06-15 10:55 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbctrac.dll
2013-08-27 05:48 - 2011-06-15 10:55 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccp32.dll
2013-08-27 05:48 - 2011-06-15 10:55 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccu32.dll
2013-08-27 05:48 - 2011-06-15 10:55 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccr32.dll
2013-08-27 05:48 - 2011-02-05 19:10 - 00642944 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-08-27 05:48 - 2011-02-05 19:10 - 00020352 _____ (Microsoft Corporation) C:\Windows\system32\kdusb.dll
2013-08-27 05:48 - 2011-02-05 19:10 - 00019328 _____ (Microsoft Corporation) C:\Windows\system32\kd1394.dll
2013-08-27 05:48 - 2011-02-05 19:10 - 00017792 _____ (Microsoft Corporation) C:\Windows\system32\kdcom.dll
2013-08-27 05:48 - 2011-02-05 19:06 - 00605552 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-08-27 05:48 - 2011-02-05 19:06 - 00566208 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-08-27 05:48 - 2011-02-05 19:06 - 00518672 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-08-27 05:48 - 2010-12-23 12:42 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\sbe.dll
2013-08-27 05:48 - 2010-12-23 12:42 - 00961024 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2013-08-27 05:48 - 2010-12-23 12:36 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\mpg2splt.ax
2013-08-27 05:48 - 2010-12-23 07:54 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sbe.dll
2013-08-27 05:48 - 2010-12-23 07:54 - 00642048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2013-08-27 05:48 - 2010-12-23 07:50 - 00199680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mpg2splt.ax
2013-08-27 05:48 - 2010-11-20 15:27 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2013-08-27 05:47 - 2013-05-02 02:06 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-08-27 05:47 - 2013-04-12 16:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2013-08-27 05:47 - 2012-11-30 01:17 - 00420064 _____ C:\Windows\SysWOW64\locale.nls
2013-08-27 05:47 - 2012-11-30 01:15 - 00420064 _____ C:\Windows\system32\locale.nls
2013-08-27 05:47 - 2011-10-15 08:31 - 00723456 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2013-08-27 05:47 - 2011-10-15 07:38 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2013-08-27 05:47 - 2011-06-16 07:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2013-08-27 05:47 - 2011-06-16 06:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xmllite.dll
2013-08-27 05:47 - 2011-02-25 08:19 - 02871808 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-08-27 05:47 - 2011-02-25 07:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-08-27 05:46 - 2013-01-24 08:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-08-27 05:46 - 2012-11-01 07:43 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2013-08-27 05:46 - 2012-11-01 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2013-08-27 05:46 - 2012-11-01 06:47 - 01389568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2013-08-27 05:46 - 2012-11-01 06:47 - 01236992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2013-08-27 05:46 - 2012-07-05 00:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2013-08-27 05:46 - 2012-07-05 00:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll
2013-08-27 05:46 - 2012-07-05 00:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll
2013-08-27 05:46 - 2012-07-04 23:16 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2013-08-27 05:46 - 2012-07-04 23:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2013-08-27 05:46 - 2012-06-06 08:02 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2013-08-27 05:46 - 2012-06-06 07:03 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2013-08-27 05:46 - 2012-05-14 07:26 - 00956928 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2013-08-27 05:46 - 2012-05-05 10:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2013-08-27 05:46 - 2012-05-05 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2013-08-27 05:46 - 2012-04-26 07:41 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2013-08-27 05:46 - 2012-04-26 07:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2013-08-27 05:46 - 2012-04-26 07:34 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\rdrmemptylst.exe
2013-08-27 05:46 - 2012-04-07 14:31 - 03216384 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2013-08-27 05:46 - 2012-04-07 13:26 - 02342400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2013-08-27 05:46 - 2011-12-16 10:46 - 00634880 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2013-08-27 05:46 - 2011-12-16 09:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2013-08-27 05:46 - 2011-08-27 07:37 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-08-27 05:46 - 2011-08-27 07:37 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2013-08-27 05:46 - 2011-08-27 06:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-08-27 05:46 - 2011-08-27 06:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll
2013-08-27 05:46 - 2011-05-24 13:42 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2013-08-27 05:46 - 2011-05-24 12:40 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devobj.dll
2013-08-27 05:46 - 2011-05-24 12:40 - 00044544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devrtl.dll
2013-08-27 05:46 - 2011-05-24 12:39 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cfgmgr32.dll
2013-08-27 05:46 - 2011-05-24 12:37 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvinst.exe
2013-08-27 05:46 - 2011-05-03 07:29 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2013-08-27 05:46 - 2011-05-03 06:30 - 00741376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2013-08-27 05:46 - 2011-03-11 08:34 - 01395712 _____ (Microsoft Corporation) C:\Windows\system32\mfc42.dll
2013-08-27 05:46 - 2011-03-11 08:34 - 01359872 _____ (Microsoft Corporation) C:\Windows\system32\mfc42u.dll
2013-08-27 05:46 - 2011-03-11 07:33 - 01164288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll
2013-08-27 05:46 - 2011-03-11 07:33 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll
2013-08-27 05:46 - 2011-02-23 06:55 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2013-08-27 05:46 - 2011-02-18 12:51 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe
2013-08-27 05:46 - 2011-02-18 07:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
2013-08-27 05:46 - 2011-02-12 13:34 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOVER.exe
2013-08-27 05:46 - 2010-11-20 15:25 - 00974336 _____ (Microsoft Corporation) C:\Windows\system32\WFS.exe
2013-08-27 05:46 - 2010-11-20 15:25 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2013-08-27 05:46 - 2010-11-20 15:25 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\cfgmgr32.dll
2013-08-27 05:46 - 2010-06-26 05:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2013-08-27 05:46 - 2010-06-26 05:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2013-08-27 05:45 - 2013-01-03 08:00 - 00288088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2013-08-27 05:45 - 2012-11-02 07:59 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2013-08-27 05:45 - 2012-11-02 07:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2013-08-27 05:45 - 2012-08-22 20:12 - 00376688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2013-08-27 05:45 - 2012-06-02 07:50 - 00458704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-08-27 05:45 - 2012-06-02 07:48 - 00151920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-08-27 05:45 - 2012-06-02 07:48 - 00095600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-08-27 05:45 - 2012-06-02 07:45 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-08-27 05:45 - 2012-06-02 06:40 - 00225280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-27 05:45 - 2012-06-02 06:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-08-27 05:45 - 2012-06-02 06:34 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-08-27 05:45 - 2012-05-01 07:40 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2013-08-27 05:45 - 2012-04-28 05:55 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2013-08-27 05:45 - 2011-11-17 08:35 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-08-27 05:45 - 2011-11-17 08:35 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2013-08-27 05:45 - 2011-11-17 08:35 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-08-27 05:45 - 2011-11-17 08:35 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-08-27 05:45 - 2011-11-17 08:35 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-08-27 05:45 - 2011-11-17 08:33 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-08-27 05:45 - 2011-11-17 07:35 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2013-08-27 05:45 - 2011-08-17 07:26 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2013-08-27 05:45 - 2011-08-17 07:25 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2013-08-27 05:45 - 2011-08-17 06:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisdecd.dll
2013-08-27 05:45 - 2011-08-17 06:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisrndr.ax
2013-08-27 05:45 - 2011-07-09 04:46 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2013-08-27 05:45 - 2011-05-04 07:25 - 02315776 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2013-08-27 05:45 - 2011-05-04 07:22 - 02223616 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2013-08-27 05:45 - 2011-05-04 07:22 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2013-08-27 05:45 - 2011-05-04 07:22 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2013-08-27 05:45 - 2011-05-04 07:22 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2013-08-27 05:45 - 2011-05-04 07:22 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2013-08-27 05:45 - 2011-05-04 07:19 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2013-08-27 05:45 - 2011-05-04 07:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2013-08-27 05:45 - 2011-05-04 07:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2013-08-27 05:45 - 2011-05-04 06:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2013-08-27 05:45 - 2011-05-04 06:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2013-08-27 05:45 - 2011-05-04 06:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2013-08-27 05:45 - 2011-05-04 06:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2013-08-27 05:45 - 2011-05-04 06:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2013-08-27 05:45 - 2011-05-04 06:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2013-08-27 05:45 - 2011-05-04 06:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2013-08-27 05:45 - 2011-05-04 06:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2013-08-27 05:45 - 2011-05-04 06:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2013-08-27 05:45 - 2011-04-29 05:06 - 00467456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2013-08-27 05:45 - 2011-04-29 05:05 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2013-08-27 05:45 - 2011-04-29 05:05 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2013-08-27 05:45 - 2011-04-27 04:40 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2013-08-27 05:45 - 2011-04-27 04:39 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2013-08-27 05:45 - 2011-03-03 08:24 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2013-08-27 05:45 - 2011-03-03 08:24 - 00183296 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2013-08-27 05:45 - 2011-03-03 08:21 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\dnscacheugc.exe
2013-08-27 05:45 - 2011-03-03 07:38 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2013-08-27 05:45 - 2011-03-03 07:36 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscacheugc.exe
2013-08-27 05:45 - 2010-11-20 15:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\profprov.dll
2013-08-27 05:45 - 2010-11-20 15:24 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\MSNP.ax
2013-08-27 05:45 - 2010-11-20 15:24 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\Mpeg2Data.ax
2013-08-27 05:45 - 2010-11-20 15:24 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\MSDvbNP.ax
2013-08-27 05:45 - 2010-11-20 14:58 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\dpnaddr.dll
2013-08-27 05:45 - 2010-11-20 14:16 - 00204288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSNP.ax
2013-08-27 05:45 - 2010-11-20 14:16 - 00072704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Mpeg2Data.ax
2013-08-27 05:45 - 2010-11-20 14:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSDvbNP.ax
2013-08-27 05:45 - 2010-11-20 13:57 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnaddr.dll
2013-08-27 05:44 - 2013-02-12 06:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2013-08-27 05:44 - 2012-11-22 07:44 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2013-08-27 05:44 - 2012-11-22 06:45 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2013-08-27 05:44 - 2012-11-20 07:48 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-08-27 05:44 - 2012-11-20 06:51 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-08-27 05:44 - 2012-08-11 02:56 - 00715776 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2013-08-27 05:44 - 2012-08-11 01:56 - 00542208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2013-08-27 05:44 - 2012-03-17 09:58 - 00075120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2013-08-27 05:44 - 2011-12-30 08:26 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2013-08-27 05:44 - 2011-12-30 07:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2013-08-27 05:44 - 2011-12-28 05:59 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-08-27 05:44 - 2011-04-23 00:15 - 00027520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2013-08-27 05:40 - 2012-02-17 08:38 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2013-08-27 05:40 - 2012-02-17 07:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2013-08-27 05:40 - 2012-02-17 06:57 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2013-08-27 05:35 - 2012-02-11 08:36 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2013-08-27 05:35 - 2012-02-11 08:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2013-08-27 05:35 - 2011-11-19 16:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2013-08-27 05:35 - 2011-11-19 16:01 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2013-08-27 05:31 - 2012-06-03 00:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-08-27 05:31 - 2012-06-03 00:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-08-27 05:31 - 2012-06-03 00:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-08-27 05:31 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-08-27 05:31 - 2012-06-03 00:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-08-27 05:31 - 2012-06-03 00:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-08-27 05:31 - 2012-06-03 00:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-08-27 05:31 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-08-27 05:31 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-08-27 05:28 - 2013-08-27 05:28 - 00001351 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2013-08-27 05:27 - 2013-09-08 19:21 - 01589442 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

TattooPanda · 14.09.2013, 19:15

FRST 4 von 4

Code:

ATTFilter

2013-08-27 05:25 - 2013-09-14 14:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-27 05:25 - 2013-08-27 05:25 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Vorlagen
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Startmenü
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Netzwerkumgebung
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Lokale Einstellungen
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Eigene Dateien
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Druckumgebung
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Musik
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Bilder
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Anwendungsdaten
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Anwendungsdaten
2013-08-27 05:25 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-08-27 05:25 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-08-27 05:24 - 2013-09-03 02:39 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-08-27 05:24 - 2013-08-27 10:27 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-08-27 05:24 - 2013-06-21 14:06 - 27781920 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 21102368 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 15920536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 15144928 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 13411896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 12427240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 11235104 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-08-27 05:24 - 2013-06-21 14:06 - 09239344 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 07687592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 07641832 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 06324360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 02953504 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 02936208 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 02777888 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 02597856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 02363680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 02002720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 01832224 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6432049.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6432049.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 01059560 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00925648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00572704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00570656 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00467232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00465184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00432928 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00372000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00266448 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00218592 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00214448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00181488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2013-08-27 05:24 - 2013-06-21 14:06 - 00021578 _____ C:\Windows\system32\nvinfo.pb
2013-08-27 05:24 - 2013-06-21 12:23 - 06496544 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2013-08-27 05:24 - 2013-06-21 12:23 - 03514656 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2013-08-27 05:24 - 2013-06-21 12:23 - 02555680 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2013-08-27 05:24 - 2013-06-21 12:23 - 00884512 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2013-08-27 05:24 - 2013-06-21 12:23 - 00237856 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2013-08-27 05:24 - 2013-06-21 12:23 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2013-08-27 05:24 - 2013-06-20 06:17 - 03253909 _____ C:\Windows\system32\nvcoproc.bin
2013-08-27 05:24 - 2013-02-25 07:27 - 00194848 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2013-08-27 05:24 - 2013-02-25 07:27 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2013-08-27 05:24 - 2013-01-29 10:35 - 01510176 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2013-08-27 05:23 - 2013-08-27 10:28 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-08-27 05:22 - 2013-08-27 05:15 - 00344680 _____ (Realtek                                            ) C:\Windows\system32\Drivers\Rt64win7.sys
2013-08-27 05:22 - 2013-08-27 05:15 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2013-08-27 05:22 - 2013-08-27 05:15 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
2013-08-27 05:21 - 2013-08-27 05:21 - 00000000 ____D C:\Program Files (x86)\NEC Electronics
2013-08-27 05:20 - 2013-09-01 23:43 - 00000000 ____D C:\Users\Swift\AppData\Local\Downloaded Installations
2013-08-27 05:20 - 2013-08-27 05:20 - 00000000 ____D C:\NVIDIA
2013-08-27 05:18 - 2013-09-01 23:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-27 05:18 - 2013-08-27 05:22 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-08-27 05:18 - 2013-08-27 05:18 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-08-27 05:18 - 2013-08-27 05:18 - 00000000 ____D C:\Program Files\Realtek
2013-08-27 05:18 - 2013-08-27 05:15 - 02624616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 02601816 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 02419176 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2013-08-27 05:18 - 2013-08-27 05:15 - 02197264 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 02018920 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 01736536 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 01325328 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 01251944 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 01210984 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 01178384 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 01146984 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2013-08-27 05:18 - 2013-08-27 05:15 - 01110800 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00504592 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00489744 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00476264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00474896 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00372936 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00335192 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00334680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00332392 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00330656 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00315152 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00268560 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00265488 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00233064 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2013-08-27 05:18 - 2013-08-27 05:15 - 00220496 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFNHK64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00201928 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00168288 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00124128 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00124128 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00123104 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00108960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00099016 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00080720 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFCOM64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00078672 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFAPO64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00076904 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInst64.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00076488 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2013-08-27 05:18 - 2013-08-27 05:15 - 00073552 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2013-08-27 05:16 - 2013-08-27 05:16 - 00000000 ____D C:\Program Files\ATI Technologies
2013-08-27 05:16 - 2013-08-27 05:16 - 00000000 ____D C:\Program Files\ATI
2013-08-27 05:15 - 2013-08-27 06:11 - 00001769 _____ C:\Windows\Language_trs.ini
2013-08-27 05:12 - 2013-09-11 19:12 - 00000000 ___RD C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-27 05:12 - 2013-09-11 19:12 - 00000000 ___RD C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-08-27 05:12 - 2013-08-30 12:12 - 00001425 _____ C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-27 05:11 - 2013-09-14 14:41 - 00000000 ____D C:\Users\Swift
2013-08-27 05:11 - 2013-09-14 14:27 - 02027556 _____ C:\Windows\WindowsUpdate.log
2013-08-27 05:11 - 2013-09-04 16:57 - 00000000 ____D C:\Users\Swift\AppData\Local\VirtualStore
2013-08-27 05:11 - 2013-08-27 05:11 - 00000020 ___SH C:\Users\Swift\ntuser.ini
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 RSHDL C:\Users\Swift\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 RSHDL C:\Users\Swift\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Vorlagen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Startmenü
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Netzwerkumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Lokale Einstellungen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Eigene Dateien
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Druckumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\AppData\Local\Verlauf
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\AppData\Local\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 ____D C:\Recovery
2013-08-27 05:11 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-08-27 05:11 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-08-27 05:09 - 2013-08-27 05:09 - 00001313 _____ C:\Windows\TSSysprep.log
2013-08-20 07:02 - 2013-08-20 07:02 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01007.dll
2013-08-20 07:02 - 2013-08-20 07:02 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller.dll
2013-08-20 07:02 - 2013-08-20 07:02 - 00204568 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2013-08-20 07:02 - 2013-08-20 07:02 - 00103576 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys

==================== One Month Modified Files and Folders =======

2013-09-14 14:41 - 2013-09-14 14:41 - 00000542 _____ C:\Users\Swift\Desktop\defogger_disable.log
2013-09-14 14:41 - 2013-09-14 14:41 - 00000168 _____ C:\Users\Swift\defogger_reenable
2013-09-14 14:41 - 2013-09-14 14:41 - 00000000 ____D C:\FRST
2013-09-14 14:41 - 2013-08-27 05:11 - 00000000 ____D C:\Users\Swift
2013-09-14 14:40 - 2013-09-14 14:40 - 01950312 _____ (Farbar) C:\Users\Swift\Downloads\FRST64.exe
2013-09-14 14:40 - 2013-09-14 14:40 - 01950312 _____ (Farbar) C:\Users\Swift\Desktop\FRST64.exe
2013-09-14 14:40 - 2013-09-14 14:40 - 00377856 _____ C:\Users\Swift\Downloads\gmer_2.1.19163.exe
2013-09-14 14:40 - 2013-09-14 14:40 - 00377856 _____ C:\Users\Swift\Desktop\gmer_2.1.19163.exe
2013-09-14 14:39 - 2013-09-14 14:40 - 00050477 _____ C:\Users\Swift\Desktop\Defogger.exe
2013-09-14 14:39 - 2013-09-14 14:39 - 00050477 _____ C:\Users\Swift\Downloads\Defogger.exe
2013-09-14 14:27 - 2013-08-27 05:11 - 02027556 _____ C:\Windows\WindowsUpdate.log
2013-09-14 14:24 - 2013-08-27 07:16 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-14 14:24 - 2013-08-27 05:25 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-14 14:24 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-14 14:24 - 2009-07-14 06:51 - 00036823 _____ C:\Windows\setupact.log
2013-09-14 13:04 - 2013-09-14 13:03 - 28733944 _____ (VSO Software                                                ) C:\Users\Swift\Downloads\vso_video_converter_setup.exe
2013-09-14 13:04 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-14 13:04 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-14 13:03 - 2013-09-14 13:02 - 06217076 _____ (XMedia Recode                                               ) C:\Users\Swift\Downloads\XMediaRecode3172_setup.exe
2013-09-14 13:02 - 2013-08-27 09:06 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Skype
2013-09-14 12:53 - 2013-08-27 21:59 - 00000000 ___RD C:\Users\Swift\Desktop\Items
2013-09-14 03:42 - 2013-08-27 21:38 - 00000000 ____D C:\Users\Swift\AppData\Roaming\TS3Client
2013-09-14 03:21 - 2013-08-27 07:16 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-14 02:53 - 2013-09-14 00:42 - 00000000 ____D C:\Program Files (x86)\EVGA Precision X
2013-09-14 02:53 - 2013-09-03 14:39 - 00000000 ____D C:\Users\Swift\AppData\Roaming\vlc
2013-09-14 01:24 - 2013-09-11 01:08 - 00002936 _____ C:\Windows\windefendam.log
2013-09-14 01:24 - 2013-09-11 01:08 - 00000020 _____ C:\Windows\capsys184523.log
2013-09-14 00:42 - 2013-09-14 00:42 - 00001092 _____ C:\Users\Swift\Desktop\EVGA Precision X.lnk
2013-09-14 00:42 - 2013-09-14 00:42 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EVGA Precision X
2013-09-14 00:42 - 2013-09-14 00:41 - 16048384 _____ C:\Users\Swift\Downloads\EVGA_PrecisionX_Setup_421.exe
2013-09-13 23:20 - 2009-07-14 19:58 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-13 23:20 - 2009-07-14 19:58 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-13 23:20 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-13 20:33 - 2013-08-31 19:51 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-13 20:33 - 2013-08-30 19:20 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-13 20:33 - 2013-08-30 19:20 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-13 18:12 - 2013-08-27 07:38 - 00011744 _____ C:\Windows\PFRO.log
2013-09-13 15:02 - 2013-09-13 15:02 - 13499678 _____ C:\Users\Swift\Downloads\reallydeep.wmv
2013-09-13 15:01 - 2013-09-13 15:01 - 23069374 _____ C:\Users\Swift\Downloads\ff-kado.wmv
2013-09-13 15:01 - 2013-09-13 15:01 - 12660008 _____ C:\Users\Swift\Downloads\twerking.wmv
2013-09-13 15:00 - 2013-09-13 15:00 - 07803463 _____ C:\Users\Swift\Downloads\13091206.zip
2013-09-13 14:34 - 2013-09-13 14:34 - 00291606 _____ C:\Users\Swift\Downloads\TCPView.zip
2013-09-13 00:08 - 2013-09-11 01:08 - 00000000 ____D C:\Users\Swift\AppData\Local\Mirillis
2013-09-12 21:19 - 2013-09-12 21:19 - 00000000 ____D C:\Users\Swift\Documents\ProcAlyzer Dumps
2013-09-12 21:19 - 2013-09-12 21:00 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-12 21:15 - 2013-09-12 21:15 - 00377920 _____ (AVAST Software) C:\Users\Swift\Downloads\aswclear.exe
2013-09-12 21:00 - 2013-09-12 21:00 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-09-12 21:00 - 2013-09-12 21:00 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-09-12 21:00 - 2013-09-12 21:00 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-09-12 20:46 - 2013-09-12 20:46 - 00000119 _____ C:\Windows\onlineeye.INI
2013-09-12 20:45 - 2013-09-12 20:45 - 06418833 _____ (pmaSoft) C:\Users\Swift\Downloads\onlineeye.exe
2013-09-12 20:36 - 2013-09-12 20:34 - 00000000 ____D C:\Users\Swift\.zenmap
2013-09-12 20:29 - 2013-09-12 20:29 - 00000967 _____ C:\Users\Swift\Desktop\Nmap - Zenmap GUI.lnk
2013-09-12 20:29 - 2013-09-12 20:29 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nmap
2013-09-12 20:28 - 2013-09-12 20:28 - 00000000 ____D C:\Program Files (x86)\Nmap
2013-09-12 17:02 - 2013-09-12 17:02 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Wireshark
2013-09-12 17:02 - 2013-09-12 16:54 - 00000000 ____D C:\Program Files\Wireshark
2013-09-12 16:54 - 2013-09-12 16:54 - 00000000 ____D C:\Program Files (x86)\WinPcap
2013-09-12 16:34 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Eigene PSP-Dateien
2013-09-12 15:16 - 2013-09-12 14:44 - 00000000 ____D C:\Users\Swift\Desktop\Seramis
2013-09-12 13:13 - 2013-08-27 07:21 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-09-11 23:32 - 2013-09-11 23:32 - 00000000 ____D C:\Users\Swift\dwhelper
2013-09-11 19:59 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-11 19:12 - 2013-08-27 05:12 - 00000000 ___RD C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-11 19:12 - 2013-08-27 05:12 - 00000000 ___RD C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-11 19:11 - 2009-07-14 06:45 - 00308296 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 17:28 - 2013-08-27 06:20 - 00000000 ____D C:\Windows\system32\MRT
2013-09-11 17:27 - 2013-08-27 06:20 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-11 17:14 - 2013-09-11 17:12 - 73651730 _____ C:\Users\Swift\Downloads\13091102.zip
2013-09-11 17:12 - 2013-09-11 17:11 - 04319464 _____ C:\Users\Swift\Downloads\bbw-beans.wmv
2013-09-11 14:56 - 2013-09-11 14:56 - 05705512 _____ C:\Users\Swift\Downloads\bitdefender14_tsecurity.exe
2013-09-11 14:45 - 2013-09-11 14:45 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Canneverbe Limited
2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2013-09-11 14:34 - 2013-09-11 14:34 - 08435446 _____ C:\Users\Swift\Downloads\nietmooiwelgeil.wmv
2013-09-11 14:34 - 2013-09-11 14:34 - 05607766 _____ C:\Users\Swift\Downloads\goodanal.wmv
2013-09-11 02:25 - 2013-09-08 22:51 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Audacity
2013-09-11 02:22 - 2013-09-11 02:22 - 00000000 ____D C:\Users\Swift\Documents\Bandicam
2013-09-11 02:22 - 2013-09-11 02:22 - 00000000 ____D C:\Users\Swift\AppData\Roaming\BANDISOFT
2013-09-11 02:21 - 2013-09-11 02:21 - 00000992 _____ C:\Users\UpdatusUser\Desktop\Bandicam.lnk
2013-09-11 02:21 - 2013-09-11 02:21 - 00000992 _____ C:\Users\Swift\Desktop\Bandicam.lnk
2013-09-11 02:21 - 2013-09-11 02:21 - 00000000 ____D C:\Program Files (x86)\BandiMPEG1
2013-09-11 02:21 - 2013-09-11 02:21 - 00000000 ____D C:\Program Files (x86)\Bandicam
2013-09-11 01:56 - 2013-09-11 01:55 - 58140330 _____ C:\Users\Swift\Downloads\13091002.zip
2013-09-11 01:13 - 2013-09-11 01:12 - 77882478 _____ C:\Users\Swift\Downloads\13091003.zip
2013-09-11 01:08 - 2013-09-11 01:08 - 00000000 ____D C:\Users\Swift\Documents\Action!
2013-09-11 01:08 - 2013-09-11 01:08 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Mirillis
2013-09-11 01:08 - 2013-09-11 01:08 - 00000000 ____D C:\ProgramData\Mirillis
2013-09-11 01:07 - 2013-09-11 01:07 - 00002039 _____ C:\Users\Public\Desktop\Action!.lnk
2013-09-11 01:07 - 2013-09-11 01:07 - 00000000 ____D C:\Program Files (x86)\Mirillis
2013-09-11 00:52 - 2013-09-11 00:52 - 19714720 _____ (Mirillis Ltd.) C:\Users\Swift\Downloads\action_1_16_0_setup.exe
2013-09-10 20:00 - 2013-09-03 23:46 - 00000000 ____D C:\Users\Swift\Documents\AVerTV
2013-09-10 01:03 - 2013-09-10 01:02 - 14377758 _____ C:\Users\Swift\Downloads\hm-heavyorgasm.wmv
2013-09-10 01:03 - 2013-09-10 01:02 - 13011976 _____ C:\Users\Swift\Downloads\ongelegen.wmv
2013-09-10 00:50 - 2013-09-10 00:50 - 03603611 _____ C:\Users\Swift\Downloads\13090906.zip
2013-09-09 21:28 - 2013-08-27 19:19 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-09-09 19:01 - 2013-08-31 19:51 - 00000000 ____D C:\Users\Swift\AppData\Local\PunkBuster
2013-09-09 19:00 - 2013-09-09 18:54 - 00000000 ____D C:\Users\Swift\Documents\America's Army
2013-09-09 19:00 - 2013-08-27 22:05 - 00000000 ____D C:\Users\Swift\Documents\My Games
2013-09-09 18:54 - 2013-08-27 22:04 - 00466456 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2013-09-09 18:54 - 2013-08-27 22:04 - 00444952 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2013-09-09 18:54 - 2013-08-27 22:04 - 00122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2013-09-09 18:54 - 2013-08-27 22:04 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2013-09-09 18:54 - 2013-08-27 22:04 - 00000000 ____D C:\Program Files (x86)\OpenAL
2013-09-09 18:51 - 2013-08-27 12:14 - 00115450 _____ C:\Windows\DirectX.log
2013-09-09 18:10 - 2013-08-27 21:58 - 00000000 ___RD C:\Users\Swift\Desktop\Games
2013-09-09 16:44 - 2013-09-09 16:24 - 2004488510 _____ C:\Users\Swift\Downloads\zak2install.zip
2013-09-09 02:53 - 2013-09-09 02:53 - 04856260 _____ C:\Users\Swift\Downloads\groenteisbinnen.wmv
2013-09-08 22:50 - 2013-09-08 22:50 - 00001011 _____ C:\Users\Swift\Desktop\Audacity.lnk
2013-09-08 22:50 - 2013-09-08 22:50 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-09-08 22:49 - 2013-09-08 22:49 - 21281052 _____ (Audacity Team                                               ) C:\Users\Swift\Downloads\audacity-win-2.0.3.exe
2013-09-08 21:05 - 2013-09-08 21:04 - 00001510 _____ C:\Users\Swift\Desktop\Skype 2.lnk
2013-09-08 19:21 - 2013-08-27 05:27 - 01589442 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-08 19:17 - 2013-09-07 17:58 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-09-08 02:42 - 2013-09-08 02:42 - 00000000 ____D C:\Users\Swift\AppData\Roaming\dvdcss
2013-09-08 02:37 - 2013-09-08 02:37 - 28813902 _____ C:\Users\Swift\Downloads\Ultimate_Bruce_Lee_1.0.zip
2013-09-08 02:37 - 2013-09-08 02:37 - 00032783 _____ C:\Users\Swift\Downloads\rick32.zip
2013-09-08 02:37 - 2013-09-08 02:36 - 04012014 _____ C:\Users\Swift\Downloads\DONKEY_KONG_1.0.zip
2013-09-08 02:35 - 2013-09-08 02:35 - 06598337 _____ C:\Users\Swift\Downloads\Maniac Mansion 14.exe
2013-09-07 17:59 - 2013-09-07 17:59 - 00002041 _____ C:\Users\Swift\Desktop\JDownloader.lnk
2013-09-07 17:58 - 2013-09-07 17:58 - 00000000 ____D C:\Program Files (x86)\WebConnect
2013-09-07 03:04 - 2013-09-07 02:41 - 00000000 ____D C:\Users\Swift\AppData\Roaming\TeamViewer
2013-09-07 02:44 - 2013-09-07 01:56 - 207465754 _____ C:\Users\Swift\Downloads\13090606.zip
2013-09-07 02:30 - 2013-08-29 16:18 - 00000000 ____D C:\Users\Swift\Desktop\m
2013-09-07 01:48 - 2013-09-07 01:48 - 54998657 _____ C:\Users\Swift\Downloads\100_hotties.zip
2013-09-06 14:28 - 2013-09-06 03:03 - 00000000 ____D C:\Users\Swift\Downloads\Laptop Treiber
2013-09-05 22:50 - 2013-09-05 22:50 - 00000000 ____D C:\Program Files\Microsoft LifeCam
2013-09-05 22:50 - 2013-09-05 22:50 - 00000000 ____D C:\Program Files (x86)\Microsoft LifeCam
2013-09-05 21:11 - 2013-09-05 21:11 - 00002517 _____ C:\Users\Swift\Desktop\Skype.lnk
2013-09-05 15:02 - 2013-09-05 15:02 - 00000048 _____ C:\MyUpdateLogs.log
2013-09-05 15:00 - 2013-09-05 15:00 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-09-05 15:00 - 2013-09-05 15:00 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2013-09-05 14:22 - 2013-09-05 14:22 - 00162556 _____ C:\Users\Swift\Downloads\sxv185.zip
2013-09-04 17:14 - 2013-09-04 16:51 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Winamp
2013-09-04 16:57 - 2013-08-27 05:11 - 00000000 ____D C:\Users\Swift\AppData\Local\VirtualStore
2013-09-04 16:51 - 2013-09-04 16:51 - 00000000 ____D C:\Program Files (x86)\Winamp
2013-09-04 13:44 - 2013-08-28 17:36 - 00000248 _____ C:\Windows\Lexstat.ini
2013-09-04 13:40 - 2013-08-27 19:20 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Foxit Software
2013-09-04 13:23 - 2013-08-27 07:16 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-04 13:17 - 2013-08-31 20:38 - 00000000 ____D C:\Users\Swift\AppData\Roaming\XnView
2013-09-04 00:52 - 2013-08-28 03:51 - 00000000 ____D C:\ProgramData\AVerTV 3D
2013-09-03 15:44 - 2013-09-03 15:44 - 00000000 ____D C:\Program Files\Recuva
2013-09-03 15:18 - 2013-08-27 22:50 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-03 15:17 - 2013-08-27 22:50 - 00000000 ____D C:\Users\Swift\AppData\Roaming\DVDVideoSoft
2013-09-03 02:39 - 2013-08-27 05:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-09-02 00:47 - 2013-08-27 22:54 - 00000000 ____D C:\Program Files\CCleaner
2013-09-01 23:46 - 2013-09-01 23:44 - 00000000 ____D C:\ProgramData\Samsung
2013-09-01 23:46 - 2013-09-01 23:44 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-09-01 23:45 - 2013-08-27 05:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-01 23:43 - 2013-08-27 05:20 - 00000000 ____D C:\Users\Swift\AppData\Local\Downloaded Installations
2013-09-01 19:45 - 2013-08-27 21:41 - 00000000 ____D C:\Users\Swift\AppData\Roaming\NVIDIA
2013-09-01 12:50 - 2013-08-29 23:31 - 00000000 ____D C:\Users\Swift\AppData\Roaming\IrfanView
2013-08-31 23:57 - 2013-08-30 19:20 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-31 20:58 - 2013-08-31 20:58 - 00003178 _____ C:\Windows\System32\Tasks\{BD422873-5948-4239-AF84-1A0AC5434403}
2013-08-31 20:58 - 2013-08-31 20:58 - 00000000 ____D C:\Users\Swift\Downloads\it222deu
2013-08-31 20:49 - 2013-08-31 20:49 - 239417738 _____ C:\Users\Swift\Documents\backup.reg
2013-08-31 20:47 - 2013-08-31 20:47 - 04445476 _____ (Logitech                                                    ) C:\Users\Swift\Downloads\it222deu.exe
2013-08-31 20:38 - 2013-08-31 20:38 - 00000000 ____D C:\Program Files (x86)\XnView
2013-08-31 19:51 - 2013-08-31 19:51 - 00000000 ____D C:\Users\Swift\Documents\Battlefield 3
2013-08-31 19:50 - 2013-08-31 19:50 - 00000000 ____D C:\Users\Swift\AppData\Local\ESN
2013-08-31 19:50 - 2013-08-31 19:50 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-31 19:49 - 2013-08-31 19:49 - 00000000 ____D C:\ProgramData\EA Core
2013-08-31 19:49 - 2013-08-28 20:31 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-31 19:48 - 2013-08-28 20:43 - 00000000 ____D C:\Users\Swift\AppData\Local\Origin
2013-08-31 16:18 - 2013-08-31 15:46 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-31 03:35 - 2013-08-31 03:34 - 137524084 _____ C:\Users\Swift\Downloads\13082703.zip
2013-08-30 15:17 - 2013-08-30 15:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-30 15:17 - 2013-08-30 15:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-30 15:17 - 2013-08-30 15:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-30 15:17 - 2013-08-30 15:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-30 15:17 - 2013-08-30 15:17 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-30 15:17 - 2013-08-27 08:15 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-30 15:17 - 2013-08-27 08:15 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-30 15:16 - 2013-08-30 15:16 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Macromedia
2013-08-30 15:16 - 2013-08-30 15:16 - 00000000 ____D C:\Users\Swift\AppData\Local\Macromedia
2013-08-30 15:08 - 2013-08-30 15:08 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-30 15:08 - 2013-08-30 15:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-30 15:08 - 2013-08-30 15:08 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-08-30 15:08 - 2013-08-30 15:08 - 00000000 ____D C:\Windows\system32\Macromed
2013-08-30 12:12 - 2013-08-30 12:12 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Adobe
2013-08-30 12:12 - 2013-08-27 05:12 - 00001425 _____ C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-30 12:09 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-30 12:09 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-30 12:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-08-30 12:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-08-30 12:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-30 12:08 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-30 12:08 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-08-30 12:08 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\tr-TR
2013-08-30 02:53 - 2013-08-30 02:46 - 00011789 _____ C:\Windows\IE10_main.log
2013-08-30 02:49 - 2013-08-30 02:49 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-30 02:49 - 2013-08-30 02:49 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-30 02:49 - 2013-08-30 02:49 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-30 02:49 - 2013-08-30 02:49 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-30 02:49 - 2013-08-30 02:49 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-30 02:49 - 2013-08-30 02:49 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-30 02:49 - 2013-08-30 02:49 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-30 02:49 - 2013-08-30 02:49 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-30 02:49 - 2013-08-30 02:49 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-30 02:49 - 2013-08-30 02:49 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-30 02:49 - 2013-08-30 02:49 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-30 02:48 - 2013-08-30 02:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-08-30 02:48 - 2013-08-30 02:48 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-08-30 02:35 - 2013-08-27 07:16 - 00000000 ____D C:\Users\Swift\AppData\Local\Google
2013-08-30 02:35 - 2013-08-27 07:16 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-29 23:26 - 2013-08-29 23:26 - 00000000 ____D C:\Users\Swift\AppData\Roaming\ACD Systems
2013-08-29 23:26 - 2013-08-28 18:23 - 00000000 ____D C:\Users\Swift\AppData\Local\ACD Systems
2013-08-29 23:26 - 2013-08-27 07:15 - 00068328 _____ C:\Users\Swift\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-29 18:58 - 2013-08-28 18:24 - 00000000 ____D C:\Windows\ERUNT
2013-08-29 18:56 - 2013-08-28 15:32 - 00000000 ____D C:\Windows\erdnt
2013-08-29 15:11 - 2013-08-28 20:43 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Origin
2013-08-29 15:11 - 2013-08-28 20:31 - 00000000 ____D C:\ProgramData\Origin
2013-08-29 15:10 - 2013-08-27 07:21 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-29 12:14 - 2013-08-29 12:14 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-29 03:24 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-08-29 03:24 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-08-29 03:24 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-08-29 03:24 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-08-29 03:24 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-08-29 03:24 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-08-29 03:24 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-08-29 03:24 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-08-29 03:24 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing
2013-08-29 03:24 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\sppui
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\manifeststore
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\AdvancedInstallers
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sppui
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Setup
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\manifeststore
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Dism
2013-08-29 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2013-08-29 03:07 - 2009-07-14 04:36 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2013-08-29 03:07 - 2009-07-14 04:36 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll
2013-08-29 03:01 - 2013-08-29 03:01 - 00000000 ____D C:\Windows\system32\SPReview
2013-08-29 03:01 - 2013-08-29 03:01 - 00000000 ____D C:\Windows\system32\EventProviders
2013-08-29 01:58 - 2013-08-29 01:58 - 00000000 ____D C:\Users\Swift\AppData\Local\PAYDAY 2
2013-08-29 01:58 - 2013-08-29 01:58 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-08-28 18:22 - 2013-08-28 18:22 - 00000000 ____D C:\Users\Swift\AppData\Roaming\TV Movie
2013-08-28 18:21 - 2013-08-28 18:18 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:13 - 2013-08-28 18:13 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Malwarebytes
2013-08-28 18:13 - 2013-08-28 18:13 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 18:12 - 2013-08-28 18:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 18:03 - 2013-08-28 18:03 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TV Movie
2013-08-28 18:02 - 2013-08-28 18:02 - 00000000 ____D C:\Windows\Downloaded Installations
2013-08-28 18:02 - 2013-08-28 18:02 - 00000000 ____D C:\Program Files (x86)\TV Movie
2013-08-28 17:53 - 2013-08-28 17:53 - 00000000 ____D C:\ProgramData\ACD Systems
2013-08-28 17:37 - 2013-08-28 17:34 - 00014750 _____ C:\Windows\system32\LexFiles.ulf
2013-08-28 17:37 - 2013-08-28 17:34 - 00000000 ____D C:\Program Files (x86)\Lexmark X1100 Series
2013-08-28 17:36 - 2013-08-28 17:36 - 00000000 ____D C:\Program Files\Lexmark X1100 Series
2013-08-28 15:40 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-28 15:39 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-28 13:35 - 2013-08-28 13:35 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-08-28 13:23 - 2013-08-27 07:23 - 00000000 ____D C:\Users\Swift\AppData\Roaming\WinRAR
2013-08-28 03:49 - 2013-08-28 03:49 - 00000000 ____D C:\Windows\Driver Cache
2013-08-28 03:49 - 2013-08-28 03:49 - 00000000 ____D C:\Users\Swift\AppData\Local\AVerMedia
2013-08-28 03:49 - 2013-08-28 03:40 - 00000000 ____D C:\Program Files (x86)\AVerMedia
2013-08-28 00:57 - 2013-08-28 00:57 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Mozilla
2013-08-28 00:55 - 2013-08-28 00:55 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 00:55 - 2013-08-28 00:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 00:55 - 2013-08-27 23:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Swift\AppData\Local\Mozilla
2013-08-27 23:51 - 2013-08-27 23:26 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\Users\Swift\AppData\Roaming\OpenOffice
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Jasc Software Inc
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\ProgramData\InstallShield
2013-08-27 23:01 - 2013-08-27 23:01 - 00000000 ____D C:\Program Files (x86)\Jasc Software Inc
2013-08-27 22:54 - 2013-08-27 22:54 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-27 22:51 - 2013-08-27 22:51 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2013-08-27 22:48 - 2013-08-27 22:48 - 00000000 ____D C:\Program Files\VideoLAN
2013-08-27 22:41 - 2013-08-27 22:41 - 00000000 ____D C:\Users\Swift\AppData\Local\Logitech
2013-08-27 22:41 - 2013-08-27 22:41 - 00000000 ____D C:\ProgramData\LogiShrd
2013-08-27 22:40 - 2013-08-27 22:40 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2013-08-27 22:40 - 2013-08-27 22:40 - 00000776 _____ C:\Windows\LkmdfCoInst.log
2013-08-27 22:40 - 2013-08-27 22:40 - 00000000 ____D C:\Program Files\Logitech Gaming Software
2013-08-27 22:39 - 2013-08-27 22:39 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Logitech
2013-08-27 22:39 - 2013-08-27 22:39 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Logishrd
2013-08-27 22:10 - 2013-08-27 22:10 - 00000000 ____D C:\ProgramData\eBay
2013-08-27 22:10 - 2013-08-27 22:10 - 00000000 ____D C:\Program Files (x86)\eBay
2013-08-27 22:08 - 2013-08-27 22:08 - 00000000 ____D C:\Users\Swift\Documents\KARTEN
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\yourp
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA3 User Files
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA Vice City User Files
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA San Andreas User Files
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GTA
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\GHOSTBUSTERS (tm)
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Dust
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\DOTC
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Carax 95
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Bully Scholarship Edition
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Buch
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Battlefield 2
2013-08-27 22:07 - 2013-08-27 22:07 - 00000000 ____D C:\Users\Swift\Documents\Activision
2013-08-27 22:07 - 2013-08-27 22:06 - 00000000 ____D C:\Users\Swift\Documents\Turbo Lister Backup
2013-08-27 22:06 - 2013-08-27 22:06 - 00000000 ____D C:\Users\Swift\Documents\Turbo Lister
2013-08-27 22:06 - 2013-08-27 22:06 - 00000000 ____D C:\Users\Swift\Documents\Telltale Games
2013-08-27 22:05 - 2013-08-27 22:05 - 00000000 ____D C:\ProgramData\Codemasters
2013-08-27 22:04 - 2013-08-27 22:04 - 00000000 ____D C:\Program Files (x86)\BRS
2013-08-27 21:45 - 2013-08-27 21:45 - 00000000 ____D C:\Users\Swift\AppData\Local\Criterion Games
2013-08-27 21:42 - 2013-08-27 21:42 - 00000000 ____D C:\Program Files (x86)\MozBackup
2013-08-27 21:41 - 2013-08-27 21:41 - 00002090 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-08-27 21:41 - 2013-08-27 21:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-27 20:28 - 2013-08-27 20:28 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Thunderbird
2013-08-27 20:28 - 2013-08-27 20:28 - 00000000 ____D C:\Users\Swift\AppData\Local\Thunderbird
2013-08-27 20:27 - 2013-08-27 20:27 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-27 20:24 - 2013-08-27 07:23 - 00000000 ____D C:\Program Files\WinRAR
2013-08-27 19:23 - 2013-08-27 19:23 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-27 19:22 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-27 19:20 - 2013-08-27 19:20 - 00000000 ____D C:\Program Files (x86)\Foxit Software
2013-08-27 19:19 - 2013-08-27 19:19 - 00000967 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-08-27 19:19 - 2013-08-27 19:19 - 00000000 ____D C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-08-27 19:18 - 2013-08-27 19:18 - 00000000 ____D C:\Users\Swift\Desktop\mp3
2013-08-27 19:17 - 2013-08-27 19:17 - 00000400 _____ C:\Windows\ODBC.INI
2013-08-27 19:17 - 2009-07-14 04:34 - 00000499 _____ C:\Windows\win.ini
2013-08-27 19:16 - 2013-08-27 19:16 - 00000000 ____D C:\Windows\PCHEALTH
2013-08-27 19:16 - 2013-08-27 19:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-08-27 19:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system
2013-08-27 19:13 - 2013-08-27 19:13 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-08-27 19:13 - 2013-08-27 19:13 - 00000000 ____D C:\Users\Swift\AppData\Roaming\DAEMON Tools Lite
2013-08-27 19:13 - 2013-08-27 19:13 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-08-27 19:13 - 2013-08-27 19:12 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-08-27 10:28 - 2013-08-27 10:28 - 00000000 ____D C:\NvidiaLogging
2013-08-27 10:28 - 2013-08-27 05:23 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-08-27 10:27 - 2013-08-27 10:27 - 00000000 ____D C:\Users\Swift\AppData\Local\NVIDIA
2013-08-27 10:27 - 2013-08-27 05:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-08-27 09:06 - 2013-08-27 09:06 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-27 09:06 - 2013-08-27 09:06 - 00000000 ____D C:\ProgramData\Skype
2013-08-27 08:15 - 2013-08-27 08:15 - 00000000 ____D C:\ProgramData\Sun
2013-08-27 07:41 - 2013-08-27 07:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2013-08-27 07:21 - 2013-08-27 07:21 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-08-27 07:21 - 2013-08-27 07:21 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-08-27 07:21 - 2013-08-27 07:21 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-08-27 07:21 - 2013-08-27 07:21 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-08-27 07:21 - 2013-08-27 07:21 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-08-27 07:21 - 2013-08-27 07:21 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-08-27 07:20 - 2013-08-27 07:20 - 00000000 ____D C:\Program Files\AVAST Software
2013-08-27 07:20 - 2013-08-27 07:18 - 00000000 ____D C:\ProgramData\AVAST Software
2013-08-27 07:16 - 2013-08-27 07:16 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-08-27 07:16 - 2013-08-27 07:16 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-08-27 07:16 - 2013-08-27 07:15 - 00000000 ____D C:\Users\Swift\AppData\Local\Deployment
2013-08-27 07:15 - 2013-08-27 07:15 - 00000000 ____D C:\Users\Swift\AppData\Local\Apps\2.0
2013-08-27 07:14 - 2013-08-27 07:14 - 00003536 _____ C:\Windows\System32\Tasks\CreateChoiceProcessTask
2013-08-27 06:20 - 2013-08-27 06:18 - 00004747 _____ C:\Windows\IE9_main.log
2013-08-27 06:12 - 2013-08-27 06:11 - 00035545 _____ C:\Windows\Ascd_tmp.ini
2013-08-27 06:11 - 2013-08-27 05:15 - 00001769 _____ C:\Windows\Language_trs.ini
2013-08-27 06:05 - 2009-07-14 07:38 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG
2013-08-27 06:05 - 2009-07-14 07:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2013-08-27 05:28 - 2013-08-27 05:28 - 00001351 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2013-08-27 05:25 - 2013-08-27 05:25 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Vorlagen
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Startmenü
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Netzwerkumgebung
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Lokale Einstellungen
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Eigene Dateien
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Druckumgebung
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Musik
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Bilder
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Anwendungsdaten
2013-08-27 05:25 - 2013-08-27 05:25 - 00000000 _SHDL C:\Users\UpdatusUser\Anwendungsdaten
2013-08-27 05:24 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Help
2013-08-27 05:23 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-27 05:22 - 2013-08-27 05:18 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-08-27 05:21 - 2013-08-27 05:21 - 00000000 ____D C:\Program Files (x86)\NEC Electronics
2013-08-27 05:21 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\restore
2013-08-27 05:20 - 2013-08-27 05:20 - 00000000 ____D C:\NVIDIA
2013-08-27 05:18 - 2013-08-27 05:18 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-08-27 05:18 - 2013-08-27 05:18 - 00000000 ____D C:\Program Files\Realtek
2013-08-27 05:16 - 2013-08-27 05:16 - 00000000 ____D C:\Program Files\ATI Technologies
2013-08-27 05:16 - 2013-08-27 05:16 - 00000000 ____D C:\Program Files\ATI
2013-08-27 05:15 - 2013-08-27 05:22 - 00344680 _____ (Realtek                                            ) C:\Windows\system32\Drivers\Rt64win7.sys
2013-08-27 05:15 - 2013-08-27 05:22 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2013-08-27 05:15 - 2013-08-27 05:22 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 02624616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 02601816 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 02419176 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2013-08-27 05:15 - 2013-08-27 05:18 - 02197264 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 02018920 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 01736536 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 01325328 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 01251944 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 01210984 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 01178384 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 01146984 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2013-08-27 05:15 - 2013-08-27 05:18 - 01110800 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00504592 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00489744 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00476264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00474896 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00372936 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00335192 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00334680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00332392 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00330656 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00315152 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00268560 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00265488 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00233064 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2013-08-27 05:15 - 2013-08-27 05:18 - 00220496 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFNHK64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00201928 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00168288 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00124128 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00124128 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00123104 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00108960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00099016 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00080720 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFCOM64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00078672 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFAPO64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00076904 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInst64.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00076488 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2013-08-27 05:15 - 2013-08-27 05:18 - 00073552 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2013-08-27 05:15 - 2009-08-24 06:55 - 00016440 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\Drivers\AtiPcie.sys
2013-08-27 05:11 - 2013-08-27 06:05 - 00000000 ____D C:\Windows\Panther
2013-08-27 05:11 - 2013-08-27 05:11 - 00000020 ___SH C:\Users\Swift\ntuser.ini
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 RSHDL C:\Users\Swift\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 RSHDL C:\Users\Swift\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Vorlagen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Startmenü
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Netzwerkumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Lokale Einstellungen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Eigene Dateien
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Druckumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\AppData\Local\Verlauf
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\AppData\Local\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Swift\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Programme
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-08-27 05:11 - 2013-08-27 05:11 - 00000000 ____D C:\Recovery
2013-08-27 05:11 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Windows NT
2013-08-27 05:09 - 2013-08-27 05:09 - 00001313 _____ C:\Windows\TSSysprep.log
2013-08-27 05:09 - 2009-07-14 06:46 - 00001774 _____ C:\Windows\DtcInstall.log
2013-08-27 05:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-08-20 15:33 - 2013-09-03 02:38 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-08-20 15:32 - 2013-09-03 02:38 - 00028448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-08-20 15:32 - 2013-08-27 10:27 - 00029984 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-08-20 07:02 - 2013-08-20 07:02 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01007.dll
2013-08-20 07:02 - 2013-08-20 07:02 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller.dll
2013-08-20 07:02 - 2013-08-20 07:02 - 00204568 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2013-08-20 07:02 - 2013-08-20 07:02 - 00103576 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys

Some content of TEMP:
====================
C:\Users\Swift\AppData\Local\Temp\rtdrvmon.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 19:51

==================== End Of Log ============================

TattooPanda · 14.09.2013, 19:17

GMER :

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-14 14:48:35
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD10EZEX-00ZF5A0 rev.80.00A80 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Swift\AppData\Local\Temp\fgloypob.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                        0000000077331360 5 bytes JMP 0000000149a70460
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                 00000000773313b0 5 bytes JMP 0000000149a70450
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                 0000000077331510 5 bytes JMP 0000000149a70370
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                      0000000077331560 5 bytes JMP 0000000149a70470
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                            0000000077331570 5 bytes JMP 0000000149a703e0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                 0000000077331620 5 bytes JMP 0000000149a70320
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                          0000000077331650 5 bytes JMP 0000000149a703b0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                             0000000077331670 5 bytes JMP 0000000149a70390
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                   00000000773316b0 5 bytes JMP 0000000149a702e0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                 0000000077331730 5 bytes JMP 0000000149a702d0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                               0000000077331750 5 bytes JMP 0000000149a70310
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                0000000077331790 5 bytes JMP 0000000149a703c0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                             00000000773317e0 5 bytes JMP 0000000149a703f0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                0000000077331940 5 bytes JMP 0000000149a70230
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                     0000000077331b00 5 bytes JMP 0000000149a70480
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                    0000000077331b30 5 bytes JMP 0000000149a703a0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                             0000000077331c10 5 bytes JMP 0000000149a702f0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                          0000000077331c20 5 bytes JMP 0000000149a70350
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                0000000077331c80 5 bytes JMP 0000000149a70290
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                             0000000077331d10 5 bytes JMP 0000000149a702b0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                              0000000077331d30 5 bytes JMP 0000000149a703d0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                 0000000077331d40 5 bytes JMP 0000000149a70330
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                          0000000077331db0 5 bytes JMP 0000000149a70410
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                             0000000077331de0 5 bytes JMP 0000000149a70240
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                  00000000773320a0 5 bytes JMP 0000000149a701e0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                             0000000077332160 5 bytes JMP 0000000149a70250
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                             0000000077332190 5 bytes JMP 0000000149a70490
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                    00000000773321a0 5 bytes JMP 0000000149a704a0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                               00000000773321d0 5 bytes JMP 0000000149a70300
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                            00000000773321e0 5 bytes JMP 0000000149a70360
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                  0000000077332240 5 bytes JMP 0000000149a702a0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                               0000000077332290 5 bytes JMP 0000000149a702c0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                  00000000773322c0 5 bytes JMP 0000000149a70380
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                   00000000773322d0 5 bytes JMP 0000000149a70340
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                            00000000773325c0 5 bytes JMP 0000000149a70440
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                           00000000773327c0 5 bytes JMP 0000000149a70260
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                              00000000773327d0 5 bytes JMP 0000000149a70270
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                            00000000773327e0 5 bytes JMP 0000000149a70400
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                        00000000773329a0 5 bytes JMP 0000000149a701f0
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                         00000000773329b0 5 bytes JMP 0000000149a70210
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                              0000000077332a20 5 bytes JMP 0000000149a70200
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                              0000000077332a80 5 bytes JMP 0000000149a70420
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                               0000000077332a90 5 bytes JMP 0000000149a70430
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                          0000000077332aa0 5 bytes JMP 0000000149a70220
.text  C:\Windows\system32\csrss.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                  0000000077332b80 5 bytes JMP 0000000149a70280
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                           0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\wininit.exe[596] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                     000000007721eecd 1 byte [62]
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                        0000000077331360 5 bytes JMP 0000000149a70460
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                 00000000773313b0 5 bytes JMP 0000000149a70450
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                 0000000077331510 5 bytes JMP 0000000149a70370
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                      0000000077331560 5 bytes JMP 0000000149a70470
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                            0000000077331570 5 bytes JMP 0000000149a703e0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                 0000000077331620 5 bytes JMP 0000000149a70320
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                          0000000077331650 5 bytes JMP 0000000149a703b0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                             0000000077331670 5 bytes JMP 0000000149a70390
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                   00000000773316b0 5 bytes JMP 0000000149a702e0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                 0000000077331730 5 bytes JMP 0000000149a702d0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                               0000000077331750 5 bytes JMP 0000000149a70310
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                0000000077331790 5 bytes JMP 0000000149a703c0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                             00000000773317e0 5 bytes JMP 0000000149a703f0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                0000000077331940 5 bytes JMP 0000000149a70230
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                     0000000077331b00 5 bytes JMP 0000000149a70480
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                    0000000077331b30 5 bytes JMP 0000000149a703a0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                             0000000077331c10 5 bytes JMP 0000000149a702f0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                          0000000077331c20 5 bytes JMP 0000000149a70350
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                0000000077331c80 5 bytes JMP 0000000149a70290
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                             0000000077331d10 5 bytes JMP 0000000149a702b0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                              0000000077331d30 5 bytes JMP 0000000149a703d0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                 0000000077331d40 5 bytes JMP 0000000149a70330
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                          0000000077331db0 5 bytes JMP 0000000149a70410
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                             0000000077331de0 5 bytes JMP 0000000149a70240
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                  00000000773320a0 5 bytes JMP 0000000149a701e0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                             0000000077332160 5 bytes JMP 0000000149a70250
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                             0000000077332190 5 bytes JMP 0000000149a70490
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                    00000000773321a0 5 bytes JMP 0000000149a704a0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                               00000000773321d0 5 bytes JMP 0000000149a70300
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                            00000000773321e0 5 bytes JMP 0000000149a70360
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                  0000000077332240 5 bytes JMP 0000000149a702a0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                               0000000077332290 5 bytes JMP 0000000149a702c0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                  00000000773322c0 5 bytes JMP 0000000149a70380
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                   00000000773322d0 5 bytes JMP 0000000149a70340
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                            00000000773325c0 5 bytes JMP 0000000149a70440
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                           00000000773327c0 5 bytes JMP 0000000149a70260
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                              00000000773327d0 5 bytes JMP 0000000149a70270
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                            00000000773327e0 5 bytes JMP 0000000149a70400
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                        00000000773329a0 5 bytes JMP 0000000149a701f0
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                         00000000773329b0 5 bytes JMP 0000000149a70210
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                              0000000077332a20 5 bytes JMP 0000000149a70200
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                              0000000077332a80 5 bytes JMP 0000000149a70420
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                               0000000077332a90 5 bytes JMP 0000000149a70430
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                          0000000077332aa0 5 bytes JMP 0000000149a70220
.text  C:\Windows\system32\csrss.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                  0000000077332b80 5 bytes JMP 0000000149a70280
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\services.exe[684] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\winlogon.exe[692] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                        0000000077331360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                 00000000773313b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                 0000000077331510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                      0000000077331560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                            0000000077331570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                 0000000077331620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                          0000000077331650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                             0000000077331670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                   00000000773316b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                 0000000077331730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                               0000000077331750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                0000000077331790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                             00000000773317e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                0000000077331940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                     0000000077331b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                    0000000077331b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                             0000000077331c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                          0000000077331c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                0000000077331c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                             0000000077331d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                              0000000077331d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                 0000000077331d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                          0000000077331db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                             0000000077331de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                  00000000773320a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                             0000000077332160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                             0000000077332190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                    00000000773321a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                               00000000773321d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                            00000000773321e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                  0000000077332240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                               0000000077332290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                  00000000773322c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                   00000000773322d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                            00000000773325c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                           00000000773327c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                              00000000773327d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                            00000000773327e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                        00000000773329a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                         00000000773329b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                              0000000077332a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                              0000000077332a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                               0000000077332a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                          0000000077332aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\lsass.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                  0000000077332b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                          0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                   00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                   0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                        0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                              0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                   0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                            0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                               0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                     00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                   0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                 0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                  0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                               00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                  0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                       0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                      0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                               0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                            0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                  0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                               0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                   0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                            0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                               0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                    00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                               0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                               0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                      00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                                 00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                              00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                    0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                                 0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                    00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                     00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                              00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                             00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                                00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                              00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                          00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                           00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                                0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                 0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                            0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\lsm.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                    0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                           0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\svchost.exe[836] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                     000000007721eecd 1 byte [62]
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                       0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                     0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                           0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                         0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                            0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                  00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                              0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                               0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                            00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                               0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                    0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                   0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                            0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                         0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                               0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                            0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                             0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                         0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                            0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                 00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                            0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                            0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                   00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                              00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                           00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                 0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                              0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                 00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                  00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                           00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                          00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                             00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                           00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                       00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                        00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                             0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                             0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                              0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                         0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                 0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\nvvsvc.exe[928] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                      000000007721eecd 1 byte [62]
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[952] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                 00000000757da2ba 1 byte [62]
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                           0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey

TattooPanda · 14.09.2013, 19:18

Code:

ATTFilter

.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\System32\svchost.exe[484] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                     000000007721eecd 1 byte [62]
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000100070460
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000100070450
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000100070370
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000100070470
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000001000703e0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000100070320
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000001000703b0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000100070390
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000001000702d0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000100070310
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000001000703c0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000100070230
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000100070480
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000100070350
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000100070290
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000100070330
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000100070410
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000100070240
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000100070250
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                           0000000077332190 5 bytes JMP 0000000100070490
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000100070300
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000100070360
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000001000702a0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000001000702c0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000100070380
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000100070340
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000100070440
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000100070260
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000100070270
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000100070400
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000100070210
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000100070200
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000100070420
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000100070430
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000100070280
.text  C:\Windows\System32\svchost.exe[532] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                     000000007721eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                           0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\svchost.exe[516] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                     000000007721eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                           0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\svchost.exe[980] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                     000000007721eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\svchost.exe[1228] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                            0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                     00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                     0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                          0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                     0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                              0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                 0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                       00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                     0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                   0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                    0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                 00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                    0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                         0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                        0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                 0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                              0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                    0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                 0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                  0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                     0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                              0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                 0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                      00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                 0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                 0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                        00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                   00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                      0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                   0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                      00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                       00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                               00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                  00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                            00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                             00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                  0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                  0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                   0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                              0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                      0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1392] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                           000000007721eecd 1 byte [62]
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                      0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                               00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                               0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                    0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                          0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                               0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                           0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                 00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                               0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                             0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                              0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                           00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                              0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                   0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                  0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                           0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                        0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                              0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                           0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                               0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                        0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                           0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                           0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                           0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                  00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                             00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                          00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                             0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                 00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                          00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                         00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                            00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                      00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                       00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                            0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                            0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                             0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                        0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\nvvsvc.exe[1404] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                     000000007721eecd 1 byte [62]
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000100070460
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000100070450
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000100070370
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000100070470
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000001000703e0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000100070320
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000001000703b0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000100070390
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000001000702d0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000100070310
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000001000703c0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000100070230
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000100070480
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000100070350
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000100070290
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000100070330
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000100070410
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000100070240
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000100070250
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000100070490
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000100070300
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000100070360
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000001000702a0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000001000702c0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000100070380
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000100070340
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000100070440
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000100070260
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000100070270
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 0000000100070400
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000100070210
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000100070200
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000100070420
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000100070430
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000100070280
.text  C:\Windows\System32\spoolsv.exe[1704] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\svchost.exe[1768] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189

TattooPanda · 14.09.2013, 19:19

Code:

ATTFilter

.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                               00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                   00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                    00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                    00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                            00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                          0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                               00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                            0000000076ff5181 5 bytes JMP 0000000100241014
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                0000000076ff5254 5 bytes JMP 0000000100240804
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                0000000076ff53d5 5 bytes JMP 0000000100240a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                               0000000076ff54c2 5 bytes JMP 0000000100240c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                               0000000076ff55e2 5 bytes JMP 0000000100240e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                      0000000076ff567c 5 bytes JMP 00000001002401f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                      0000000076ff589f 5 bytes JMP 00000001002403fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\SysWOW64\sechost.dll!DeleteService                                       0000000076ff5a22 5 bytes JMP 0000000100240600
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                      0000000076d3ee09 5 bytes JMP 00000001002501f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                       0000000076d43982 5 bytes JMP 00000001002503fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                    0000000076d47603 5 bytes JMP 0000000100250804
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                    0000000076d4835c 5 bytes JMP 0000000100250600
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe[1176] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                  0000000076d5f52b 5 bytes JMP 0000000100250a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                      00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                          00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                           00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                       00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                           00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                   00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                 0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                      00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\syswow64\USER32.dll!SetWinEventHook                             0000000076d3ee09 5 bytes JMP 00000001002401f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                              0000000076d43982 5 bytes JMP 00000001002403fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                           0000000076d47603 5 bytes JMP 0000000100240804
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                           0000000076d4835c 5 bytes JMP 0000000100240600
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                         0000000076d5f52b 5 bytes JMP 0000000100240a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                   0000000076ff5181 5 bytes JMP 0000000100251014
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                       0000000076ff5254 5 bytes JMP 0000000100250804
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                       0000000076ff53d5 5 bytes JMP 0000000100250a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                      0000000076ff54c2 5 bytes JMP 0000000100250c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                      0000000076ff55e2 5 bytes JMP 0000000100250e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                             0000000076ff567c 5 bytes JMP 00000001002501f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                             0000000076ff589f 5 bytes JMP 00000001002503fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe[1248] C:\Windows\SysWOW64\sechost.dll!DeleteService                              0000000076ff5a22 5 bytes JMP 0000000100250600
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                   00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                       00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                        00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                        00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                              0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                   00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                          0000000076d3ee09 5 bytes JMP 00000001001101f8
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                           0000000076d43982 5 bytes JMP 00000001001103fc
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                        0000000076d47603 5 bytes JMP 0000000100110804
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                        0000000076d4835c 5 bytes JMP 0000000100110600
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                      0000000076d5f52b 5 bytes JMP 0000000100110a08
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                0000000076ff5181 5 bytes JMP 00000001001a1014
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                    0000000076ff5254 5 bytes JMP 00000001001a0804
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                    0000000076ff53d5 5 bytes JMP 00000001001a0a08
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                   0000000076ff54c2 5 bytes JMP 00000001001a0c0c
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                   0000000076ff55e2 5 bytes JMP 00000001001a0e10
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                          0000000076ff567c 5 bytes JMP 00000001001a01f8
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                          0000000076ff589f 5 bytes JMP 00000001001a03fc
.text  C:\Program Files (x86)\AVerMedia\AVerUpdate\AVerUpdateServer.exe[1436] C:\Windows\SysWOW64\sechost.dll!DeleteService                                           0000000076ff5a22 5 bytes JMP 00000001001a0600
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                    000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                    000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                   000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                   000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                          000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                          000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\lxbkcoms.exe[1344] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                           000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                               0000000077303b10 5 bytes JMP 000000010030075c
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                 0000000077307ac0 5 bytes JMP 00000001003003a4
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                     0000000077331360 5 bytes JMP 0000000100070460
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                              00000000773313b0 5 bytes JMP 0000000100070450
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                    0000000077331430 5 bytes JMP 0000000100300b14
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                        0000000077331490 5 bytes JMP 0000000100300ecc
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                              0000000077331510 5 bytes JMP 0000000100070370
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                   0000000077331560 5 bytes JMP 0000000100070470
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                         0000000077331570 5 bytes JMP 000000010030163c
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                              0000000077331620 5 bytes JMP 0000000100070320
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                       0000000077331650 5 bytes JMP 00000001000703b0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                          0000000077331670 5 bytes JMP 0000000100070390
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                00000000773316b0 5 bytes JMP 00000001000702e0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                              0000000077331730 5 bytes JMP 00000001000702d0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                            0000000077331750 5 bytes JMP 0000000100070310
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                             0000000077331790 5 bytes JMP 00000001000703c0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                     00000000773317b0 5 bytes JMP 0000000100301284
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                          00000000773317e0 5 bytes JMP 00000001000703f0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                             0000000077331940 5 bytes JMP 0000000100070230
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                  0000000077331b00 5 bytes JMP 0000000100070480
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                 0000000077331b30 5 bytes JMP 00000001000703a0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                          0000000077331c10 5 bytes JMP 00000001000702f0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                       0000000077331c20 5 bytes JMP 0000000100070350
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                             0000000077331c80 5 bytes JMP 0000000100070290
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                          0000000077331d10 5 bytes JMP 00000001000702b0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                           0000000077331d30 5 bytes JMP 00000001000703d0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                              0000000077331d40 5 bytes JMP 0000000100070330
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                       0000000077331db0 5 bytes JMP 0000000100070410
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                          0000000077331de0 5 bytes JMP 0000000100070240
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                               00000000773320a0 5 bytes JMP 00000001000701e0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                          0000000077332160 5 bytes JMP 0000000100070250
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                          0000000077332190 5 bytes JMP 0000000100070490
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                 00000000773321a0 5 bytes JMP 00000001000704a0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                            00000000773321d0 5 bytes JMP 0000000100070300
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                         00000000773321e0 5 bytes JMP 0000000100070360
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                               0000000077332240 5 bytes JMP 00000001000702a0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                            0000000077332290 5 bytes JMP 00000001000702c0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                               00000000773322c0 5 bytes JMP 0000000100070380
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                00000000773322d0 5 bytes JMP 0000000100070340
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                         00000000773325c0 5 bytes JMP 0000000100070440
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                        00000000773327c0 5 bytes JMP 0000000100070260
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                           00000000773327d0 5 bytes JMP 0000000100070270
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                         00000000773327e0 5 bytes JMP 00000001003019f4
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                     00000000773329a0 5 bytes JMP 00000001000701f0
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                      00000000773329b0 5 bytes JMP 0000000100070210
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                           0000000077332a20 5 bytes JMP 0000000100070200
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                           0000000077332a80 5 bytes JMP 0000000100070420
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                            0000000077332a90 5 bytes JMP 0000000100070430
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                       0000000077332aa0 5 bytes JMP 0000000100070220
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                               0000000077332b80 5 bytes JMP 0000000100070280
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                    000000007721eecd 1 byte [62]
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Program Files\Microsoft LifeCam\MSCamS64.exe[2064] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                              0000000077303b10 5 bytes JMP 000000010011075c
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                0000000077307ac0 5 bytes JMP 00000001001103a4
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                   0000000077331430 5 bytes JMP 0000000100110b14
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                       0000000077331490 5 bytes JMP 0000000100110ecc
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        0000000077331570 5 bytes JMP 000000010011163c
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                    00000000773317b0 5 bytes JMP 0000000100111284
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000773327e0 5 bytes JMP 00000001001119f4
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                   000000007721eecd 1 byte [62]
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                    000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                    000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                   000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                   000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                          000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                          000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\taskhost.exe[2180] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                           000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                                   0000000077303b10 5 bytes JMP 000000010030075c
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                     0000000077307ac0 5 bytes JMP 00000001003003a4
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                         0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                  00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                        0000000077331430 5 bytes JMP 0000000100300b14
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                            0000000077331490 5 bytes JMP 0000000100300ecc
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                  0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                       0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                             0000000077331570 5 bytes JMP 000000010030163c
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                  0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                           0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                              0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                    00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                  0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                 0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                         00000000773317b0 5 bytes JMP 0000000100301284
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                              00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                 0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                      0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                     0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                              0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                           0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                 0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                              0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                               0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                  0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                           0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                              0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                   00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                              0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                              0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                     00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                                00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                             00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                   0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                                0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                   00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                    00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                             00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                            00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                               00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                             00000000773327e0 5 bytes JMP 00000001003019f4
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                         00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                          00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                               0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                               0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                           0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                   0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                     000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                         000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                         000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                        000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                        000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                               000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                               000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\Dwm.exe[2420] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                                000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                                       0000000077303b10 5 bytes JMP 00000001001c075c
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                         0000000077307ac0 5 bytes JMP 00000001001c03a4
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                             0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                      00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                            0000000077331430 5 bytes JMP 00000001001c0b14
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                0000000077331490 5 bytes JMP 00000001001c0ecc
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                      0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                           0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                 0000000077331570 5 bytes JMP 00000001001c163c
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                      0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                               0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                  0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                        00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                      0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                    0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                     0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                             00000000773317b0 5 bytes JMP 00000001001c1284
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                  00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                     0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                          0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                         0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                                  0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                               0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                     0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                                  0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                   0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                      0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                               0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                                  0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                       00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                                  0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                                  0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                         00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                                    00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                                 00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                       0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                                    0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                       00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                        00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                                 00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                                00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                                   00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                 00000000773327e0 5 bytes JMP 00000001001c19f4
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                             00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                              00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                                   0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                   0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                    0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                               0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                       0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                            000000007721eecd 1 byte [62]
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                         000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                             000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                             000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                            000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                            000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                                   000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                                   000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\Explorer.EXE[2460] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                                    000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                               0000000077303b10 5 bytes JMP 000000010051075c
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                 0000000077307ac0 5 bytes JMP 00000001005103a4
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                    0000000077331430 5 bytes JMP 0000000100510b14
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                        0000000077331490 5 bytes JMP 0000000100510ecc
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                         0000000077331570 5 bytes JMP 000000010051163c
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                     00000000773317b0 5 bytes JMP 0000000100511284
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                         00000000773327e0 5 bytes JMP 00000001005119f4
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                    000000007721eecd 1 byte [62]
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2772] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                            00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                 00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                             00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                 00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                         00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                       0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                            00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                   0000000076d3ee09 5 bytes JMP 00000001000e01f8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                    0000000076d43982 5 bytes JMP 00000001000e03fc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                 0000000076d47603 5 bytes JMP 00000001000e0804
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                 0000000076d4835c 5 bytes JMP 00000001000e0600
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                               0000000076d5f52b 5 bytes JMP 00000001000e0a08
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                         0000000076ff5181 5 bytes JMP 00000001000f1014
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                             0000000076ff5254 5 bytes JMP 00000001000f0804
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                             0000000076ff53d5 5 bytes JMP 00000001000f0a08
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                            0000000076ff54c2 5 bytes JMP 00000001000f0c0c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                            0000000076ff55e2 5 bytes JMP 00000001000f0e10
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                   0000000076ff567c 5 bytes JMP 00000001000f01f8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                   0000000076ff589f 5 bytes JMP 00000001000f03fc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2812] C:\Windows\SysWOW64\sechost.dll!DeleteService

TattooPanda · 14.09.2013, 19:20

Code:

ATTFilter

.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                        0000000077303b10 5 bytes JMP 000000010032075c
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                          0000000077307ac0 5 bytes JMP 00000001003203a4
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                              0000000077331360 5 bytes JMP 0000000100070460
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                       00000000773313b0 5 bytes JMP 0000000100070450
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                             0000000077331430 5 bytes JMP 0000000100320b14
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                 0000000077331490 5 bytes JMP 0000000100320ecc
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                       0000000077331510 5 bytes JMP 0000000100070370
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                            0000000077331560 5 bytes JMP 0000000100070470
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                  0000000077331570 5 bytes JMP 000000010032163c
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                       0000000077331620 5 bytes JMP 0000000100070320
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                0000000077331650 5 bytes JMP 00000001000703b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                   0000000077331670 5 bytes JMP 0000000100070390
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                         00000000773316b0 5 bytes JMP 00000001000702e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                       0000000077331730 5 bytes JMP 00000001000702d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                     0000000077331750 5 bytes JMP 0000000100070310
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                      0000000077331790 5 bytes JMP 00000001000703c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                              00000000773317b0 5 bytes JMP 0000000100321284
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                   00000000773317e0 5 bytes JMP 00000001000703f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                      0000000077331940 5 bytes JMP 0000000100070230
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                           0000000077331b00 5 bytes JMP 0000000100070480
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                          0000000077331b30 5 bytes JMP 00000001000703a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                   0000000077331c10 5 bytes JMP 00000001000702f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                0000000077331c20 5 bytes JMP 0000000100070350
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                      0000000077331c80 5 bytes JMP 0000000100070290
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                   0000000077331d10 5 bytes JMP 00000001000702b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                    0000000077331d30 5 bytes JMP 00000001000703d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                       0000000077331d40 5 bytes JMP 0000000100070330
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                0000000077331db0 5 bytes JMP 0000000100070410
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                   0000000077331de0 5 bytes JMP 0000000100070240
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                        00000000773320a0 5 bytes JMP 00000001000701e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                   0000000077332160 5 bytes JMP 0000000100070250
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                   0000000077332190 5 bytes JMP 0000000100070490
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                          00000000773321a0 5 bytes JMP 00000001000704a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                     00000000773321d0 5 bytes JMP 0000000100070300
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                  00000000773321e0 5 bytes JMP 0000000100070360
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                        0000000077332240 5 bytes JMP 00000001000702a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                     0000000077332290 5 bytes JMP 00000001000702c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                        00000000773322c0 5 bytes JMP 0000000100070380
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                         00000000773322d0 5 bytes JMP 0000000100070340
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                  00000000773325c0 5 bytes JMP 0000000100070440
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                 00000000773327c0 5 bytes JMP 0000000100070260
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                    00000000773327d0 5 bytes JMP 0000000100070270
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                  00000000773327e0 5 bytes JMP 00000001003219f4
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                              00000000773329a0 5 bytes JMP 00000001000701f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                               00000000773329b0 5 bytes JMP 0000000100070210
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                    0000000077332a20 5 bytes JMP 0000000100070200
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                    0000000077332a80 5 bytes JMP 0000000100070420
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                     0000000077332a90 5 bytes JMP 0000000100070430
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                0000000077332aa0 5 bytes JMP 0000000100070220
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                        0000000077332b80 5 bytes JMP 0000000100070280
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                             000000007721eecd 1 byte [62]
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                          000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                              000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                              000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                             000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                             000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                    000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                    000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3000] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                     000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                               0000000077303b10 5 bytes JMP 00000001001a075c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                 0000000077307ac0 5 bytes JMP 00000001001a03a4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                    0000000077331430 5 bytes JMP 00000001001a0b14
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                        0000000077331490 5 bytes JMP 00000001001a0ecc
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                         0000000077331570 5 bytes JMP 00000001001a163c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                     00000000773317b0 5 bytes JMP 00000001001a1284
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                         00000000773327e0 5 bytes JMP 00000001001a19f4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                    000000007721eecd 1 byte [62]
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3016] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                           00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                               00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                            00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                        00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                      0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                           00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                        0000000076ff5181 5 bytes JMP 0000000100091014
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                            0000000076ff5254 5 bytes JMP 0000000100090804
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                            0000000076ff53d5 5 bytes JMP 0000000100090a08
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                           0000000076ff54c2 5 bytes JMP 0000000100090c0c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                           0000000076ff55e2 5 bytes JMP 0000000100090e10
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                  0000000076ff567c 5 bytes JMP 00000001000901f8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                  0000000076ff589f 5 bytes JMP 00000001000903fc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\SysWOW64\sechost.dll!DeleteService                                   0000000076ff5a22 5 bytes JMP 0000000100090600
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                  0000000076d3ee09 5 bytes JMP 00000001000a01f8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                   0000000076d43982 5 bytes JMP 00000001000a03fc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                0000000076d47603 5 bytes JMP 00000001000a0804
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                0000000076d4835c 5 bytes JMP 00000001000a0600
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2428] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                              0000000076d5f52b 5 bytes JMP 00000001000a0a08
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                   00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                       00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                        00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                    00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                        00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                                00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                                              0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                   00000000757da2ba 1 byte [62]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                          0000000076d3ee09 5 bytes JMP 00000001002301f8
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                                           0000000076d43982 5 bytes JMP 00000001002303fc
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                        0000000076d47603 5 bytes JMP 0000000100230804
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                        0000000076d4835c 5 bytes JMP 0000000100230600
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                      0000000076d5f52b 5 bytes JMP 0000000100230a08
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                                0000000076ff5181 5 bytes JMP 0000000100241014
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                                    0000000076ff5254 5 bytes JMP 0000000100240804
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                                    0000000076ff53d5 5 bytes JMP 0000000100240a08
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                                   0000000076ff54c2 5 bytes JMP 0000000100240c0c
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                                   0000000076ff55e2 5 bytes JMP 0000000100240e10
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                                          0000000076ff567c 5 bytes JMP 00000001002401f8
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                                          0000000076ff589f 5 bytes JMP 00000001002403fc
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                                           0000000076ff5a22 5 bytes JMP 0000000100240600
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                        0000000072901a22 2 bytes [90, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                        0000000072901ad0 2 bytes [90, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                        0000000072901b08 2 bytes [90, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                        0000000072901bba 2 bytes [90, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                        0000000072901bda 2 bytes [90, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                 0000000076831465 2 bytes [83, 76]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                00000000768314bb 2 bytes [83, 76]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                     00000000774dfac0 5 bytes JMP 0000000100230600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                         00000000774dfb58 5 bytes JMP 0000000100230804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                          00000000774dfcb0 5 bytes JMP 0000000100230c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                      00000000774e0038 5 bytes JMP 0000000100230a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                          00000000774e1920 5 bytes JMP 0000000100230e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                  00000000774fc4dd 5 bytes JMP 00000001002301f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                0000000077501287 5 bytes JMP 00000001002303fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                     00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                            0000000076d3ee09 5 bytes JMP 00000001002401f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                             0000000076d43982 5 bytes JMP 00000001002403fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                          0000000076d47603 5 bytes JMP 0000000100240804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                          0000000076d4835c 5 bytes JMP 0000000100240600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                        0000000076d5f52b 5 bytes JMP 0000000100240a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                  0000000076ff5181 5 bytes JMP 0000000100251014
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                      0000000076ff5254 5 bytes JMP 0000000100250804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                      0000000076ff53d5 5 bytes JMP 0000000100250a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                     0000000076ff54c2 5 bytes JMP 0000000100250c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                     0000000076ff55e2 5 bytes JMP 0000000100250e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                            0000000076ff567c 5 bytes JMP 00000001002501f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                            0000000076ff589f 5 bytes JMP 00000001002503fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\SysWOW64\sechost.dll!DeleteService                                             0000000076ff5a22 5 bytes JMP 0000000100250600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                   0000000076831465 2 bytes [83, 76]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2444] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                  00000000768314bb 2 bytes [83, 76]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                               0000000077303b10 5 bytes JMP 000000010025075c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                 0000000077307ac0 5 bytes JMP 00000001002503a4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                    0000000077331430 5 bytes JMP 0000000100250b14
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                        0000000077331490 5 bytes JMP 0000000100250ecc
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                         0000000077331570 5 bytes JMP 000000010025163c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                     00000000773317b0 5 bytes JMP 0000000100251284
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                         00000000773327e0 5 bytes JMP 00000001002519f4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                    000000007721eecd 1 byte [62]
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1084] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                               0000000077303b10 5 bytes JMP 00000001000d075c
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                 0000000077307ac0 5 bytes JMP 00000001000d03a4
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                    0000000077331430 5 bytes JMP 00000001000d0b14
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                        0000000077331490 5 bytes JMP 00000001000d0ecc
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000001000d163c
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                     00000000773317b0 5 bytes JMP 00000001000d1284
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 00000001000d19f4
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\conhost.exe[1508] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\svchost.exe[2448] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                  00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                      00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                       00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                   00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                       00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                               00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                             0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                  00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                               0000000076ff5181 5 bytes JMP 0000000100101014
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                   0000000076ff5254 5 bytes JMP 0000000100100804
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                   0000000076ff53d5 3 bytes JMP 0000000100100a08
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW + 4                               0000000076ff53d9 1 byte [89]
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                  0000000076ff54c2 5 bytes JMP 0000000100100c0c
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                  0000000076ff55e2 5 bytes JMP 0000000100100e10
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                         0000000076ff567c 5 bytes JMP 00000001001001f8
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                         0000000076ff589f 5 bytes JMP 00000001001003fc
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\SysWOW64\sechost.dll!DeleteService                                          0000000076ff5a22 5 bytes JMP 0000000100100600
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                         0000000076d3ee09 5 bytes JMP 00000001001101f8
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                          0000000076d43982 5 bytes JMP 00000001001103fc
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                       0000000076d47603 5 bytes JMP 0000000100110804
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                       0000000076d4835c 5 bytes JMP 0000000100110600
.text  C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[1356] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                     0000000076d5f52b 5 bytes JMP 0000000100110a08
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                        0000000077303b10 5 bytes JMP 000000010040075c
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                          0000000077307ac0 5 bytes JMP 00000001004003a4
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                              0000000077331360 5 bytes JMP 00000001001f0460
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                       00000000773313b0 5 bytes JMP 00000001001f0450
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                             0000000077331430 5 bytes JMP 0000000100400b14
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                 0000000077331490 5 bytes JMP 0000000100400ecc
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                       0000000077331510 5 bytes JMP 00000001001f0370
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                            0000000077331560 5 bytes JMP 00000001001f0470
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                  0000000077331570 5 bytes JMP 000000010040163c
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                       0000000077331620 5 bytes JMP 00000001001f0320
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                0000000077331650 5 bytes JMP 00000001001f03b0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                   0000000077331670 5 bytes JMP 00000001001f0390
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                         00000000773316b0 5 bytes JMP 00000001001f02e0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                       0000000077331730 5 bytes JMP 00000001001f02d0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                     0000000077331750 5 bytes JMP 00000001001f0310
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                      0000000077331790 5 bytes JMP 00000001001f03c0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                              00000000773317b0 5 bytes JMP 0000000100401284
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                   00000000773317e0 5 bytes JMP 00000001001f03f0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                      0000000077331940 5 bytes JMP 00000001001f0230
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                           0000000077331b00 5 bytes JMP 00000001001f0480
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                          0000000077331b30 5 bytes JMP 00000001001f03a0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                   0000000077331c10 5 bytes JMP 00000001001f02f0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                0000000077331c20 5 bytes JMP 00000001001f0350
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                      0000000077331c80 5 bytes JMP 00000001001f0290
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                   0000000077331d10 5 bytes JMP 00000001001f02b0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                    0000000077331d30 5 bytes JMP 00000001001f03d0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                       0000000077331d40 5 bytes JMP 00000001001f0330
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                0000000077331db0 5 bytes JMP 00000001001f0410
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                   0000000077331de0 5 bytes JMP 00000001001f0240
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                        00000000773320a0 5 bytes JMP 00000001001f01e0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                   0000000077332160 5 bytes JMP 00000001001f0250
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                   0000000077332190 5 bytes JMP 00000001001f0490
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                          00000000773321a0 5 bytes JMP 00000001001f04a0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                     00000000773321d0 5 bytes JMP 00000001001f0300
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                  00000000773321e0 5 bytes JMP 00000001001f0360
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                        0000000077332240 5 bytes JMP 00000001001f02a0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                     0000000077332290 5 bytes JMP 00000001001f02c0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                        00000000773322c0 5 bytes JMP 00000001001f0380
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                         00000000773322d0 5 bytes JMP 00000001001f0340
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                  00000000773325c0 5 bytes JMP 00000001001f0440
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                 00000000773327c0 5 bytes JMP 00000001001f0260
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                    00000000773327d0 5 bytes JMP 00000001001f0270
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                  00000000773327e0 5 bytes JMP 00000001004019f4
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                              00000000773329a0 5 bytes JMP 00000001001f01f0
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                               00000000773329b0 5 bytes JMP 00000001001f0210
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                    0000000077332a20 5 bytes JMP 00000001001f0200
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                    0000000077332a80 5 bytes JMP 00000001001f0420
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                     0000000077332a90 5 bytes JMP 00000001001f0430
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                0000000077332aa0 5 bytes JMP 00000001001f0220
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                        0000000077332b80 5 bytes JMP 00000001001f0280
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                             000000007721eecd 1 byte [62]
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                          000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                              000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                              000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                             000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                             000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                    000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                    000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Program Files (x86)\WebConnect\updateWebConnect.exe[2656] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                     000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                               0000000077303b10 5 bytes JMP 000000010020075c
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                 0000000077307ac0 5 bytes JMP 00000001002003a4
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                    0000000077331430 5 bytes JMP 0000000100200b14
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                        0000000077331490 5 bytes JMP 0000000100200ecc
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 000000010020163c
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                     00000000773317b0 5 bytes JMP 0000000100201284
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 00000001002019f4
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\System32\svchost.exe[3100] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                         00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                     00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                         00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                 00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                               0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                    00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                           0000000076d3ee09 5 bytes JMP 00000001002c01f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                            0000000076d43982 5 bytes JMP 00000001002c03fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                         0000000076d47603 5 bytes JMP 00000001002c0804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                         0000000076d4835c 5 bytes JMP 00000001002c0600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                       0000000076d5f52b 5 bytes JMP 00000001002c0a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                 0000000076ff5181 5 bytes JMP 00000001002d1014
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                     0000000076ff5254 5 bytes JMP 00000001002d0804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                     0000000076ff53d5 5 bytes JMP 00000001002d0a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                    0000000076ff54c2 5 bytes JMP 00000001002d0c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                    0000000076ff55e2 5 bytes JMP 00000001002d0e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                           0000000076ff567c 5 bytes JMP 00000001002d01f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                           0000000076ff589f 5 bytes JMP 00000001002d03fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[3160] C:\Windows\SysWOW64\sechost.dll!DeleteService                                            0000000076ff5a22 5 bytes JMP 00000001002d0600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                         00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                     00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                         00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                 00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                               0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                    00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                           0000000076d3ee09 5 bytes JMP 00000001000a01f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                            0000000076d43982 5 bytes JMP 00000001000a03fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                         0000000076d47603 5 bytes JMP 00000001000a0804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                         0000000076d4835c 5 bytes JMP 00000001000a0600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                       0000000076d5f52b 5 bytes JMP 00000001000a0a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                 0000000076ff5181 5 bytes JMP 00000001000b1014
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                     0000000076ff5254 5 bytes JMP 00000001000b0804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                     0000000076ff53d5 5 bytes JMP 00000001000b0a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                    0000000076ff54c2 5 bytes JMP 00000001000b0c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                    0000000076ff55e2 5 bytes JMP 00000001000b0e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                           0000000076ff567c 5 bytes JMP 00000001000b01f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                           0000000076ff589f 5 bytes JMP 00000001000b03fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[3624] C:\Windows\SysWOW64\sechost.dll!DeleteService                                            0000000076ff5a22 5 bytes JMP 00000001000b0600
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                         0000000077303b10 5 bytes JMP 00000001001b075c
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                           0000000077307ac0 5 bytes JMP 00000001001b03a4
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                               0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                        00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077331430 5 bytes JMP 00000001001b0b14
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077331490 5 bytes JMP 00000001001b0ecc
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                        0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                             0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                   0000000077331570 5 bytes JMP 00000001001b163c
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                        0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                 0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                    0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                          00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                        0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                      0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                       0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000773317b0 5 bytes JMP 00000001001b1284
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                    00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                       0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                            0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                           0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                    0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                 0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                       0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                    0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                     0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                        0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                 0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                    0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                         00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                    0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                    0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                           00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                      00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                   00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                         0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                      0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                         00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                          00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                   00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                  00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                     00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                   00000000773327e0 5 bytes JMP 00000001001b19f4
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                               00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                     0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                     0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                      0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                 0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                         0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              000000007721eecd 1 byte [62]
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                           000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                               000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                               000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                     000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                     000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\SearchIndexer.exe[3908] C:\Windows\SYSTEM32\sechost.dll!DeleteService

TattooPanda · 14.09.2013, 19:22

Code:

ATTFilter

.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                               0000000077303b10 5 bytes JMP 000000010026075c
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                 0000000077307ac0 5 bytes JMP 00000001002603a4
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                    0000000077331430 5 bytes JMP 0000000100260b14
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                        0000000077331490 5 bytes JMP 0000000100260ecc
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 000000010026163c
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                     00000000773317b0 5 bytes JMP 0000000100261284
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 00000001002619f4
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\svchost.exe[3372] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                           0000000077303b10 5 bytes JMP 00000001002b075c
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                             0000000077307ac0 5 bytes JMP 00000001002b03a4
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                 0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                          00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                0000000077331430 5 bytes JMP 00000001002b0b14
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                    0000000077331490 5 bytes JMP 00000001002b0ecc
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                          0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                               0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                     0000000077331570 5 bytes JMP 00000001002b163c
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                          0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                      0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                            00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                          0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                        0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                         0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                 00000000773317b0 5 bytes JMP 00000001002b1284
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                      00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                         0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                              0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                             0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                      0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                   0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                         0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                      0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                          0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                   0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                      0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                           00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                      0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                      0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                             00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                        00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                     00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                           0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                        0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                           00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                            00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                     00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                    00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                       00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     00000000773327e0 5 bytes JMP 00000001002b19f4
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                 00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                  00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                       0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                       0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                        0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                   0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                           0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                000000007721eecd 1 byte [62]
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                             000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                 000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                 000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                       000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                       000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Program Files\Logitech Gaming Software\LCore.exe[4284] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                        000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[4308] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                 000000007721eecd 1 byte [62]
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                           00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                               00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                            00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                        00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                      0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                           00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                  0000000076d3ee09 5 bytes JMP 00000001003b01f8
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                   0000000076d43982 5 bytes JMP 00000001003b03fc
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                0000000076d47603 5 bytes JMP 00000001003b0804
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                0000000076d4835c 5 bytes JMP 00000001003b0600
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                              0000000076d5f52b 5 bytes JMP 00000001003b0a08
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                        0000000076ff5181 5 bytes JMP 00000001003c1014
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                            0000000076ff5254 5 bytes JMP 00000001003c0804
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                            0000000076ff53d5 5 bytes JMP 00000001003c0a08
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                           0000000076ff54c2 5 bytes JMP 00000001003c0c0c
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                           0000000076ff55e2 5 bytes JMP 00000001003c0e10
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                  0000000076ff567c 5 bytes JMP 00000001003c01f8
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                  0000000076ff589f 5 bytes JMP 00000001003c03fc
.text  C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe[4396] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                   0000000076ff5a22 5 bytes JMP 00000001003c0600
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                           00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                               00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                            00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                        00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                      0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                           00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                  0000000076d3ee09 5 bytes JMP 00000001002301f8
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                   0000000076d43982 5 bytes JMP 00000001002303fc
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                0000000076d47603 5 bytes JMP 0000000100230804
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                0000000076d4835c 5 bytes JMP 0000000100230600
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                              0000000076d5f52b 5 bytes JMP 0000000100230a08
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                        0000000076ff5181 5 bytes JMP 00000001002c1014
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                            0000000076ff5254 5 bytes JMP 00000001002c0804
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                            0000000076ff53d5 5 bytes JMP 00000001002c0a08
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                           0000000076ff54c2 5 bytes JMP 00000001002c0c0c
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                           0000000076ff55e2 5 bytes JMP 00000001002c0e10
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                  0000000076ff567c 5 bytes JMP 00000001002c01f8
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                  0000000076ff589f 5 bytes JMP 00000001002c03fc
.text  C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe[4412] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                   0000000076ff5a22 5 bytes JMP 00000001002c0600
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                             00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                 00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                  00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                              00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                  00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                          00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                        0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                             00000000757da2ba 1 byte [62]
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                    0000000076d3ee09 5 bytes JMP 00000001002b01f8
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                     0000000076d43982 5 bytes JMP 00000001002b03fc
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                  0000000076d47603 5 bytes JMP 00000001002b0804
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                  0000000076d4835c 5 bytes JMP 00000001002b0600
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                0000000076d5f52b 5 bytes JMP 00000001002b0a08
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                          0000000076ff5181 5 bytes JMP 00000001002c1014
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                              0000000076ff5254 5 bytes JMP 00000001002c0804
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                              0000000076ff53d5 5 bytes JMP 00000001002c0a08
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                             0000000076ff54c2 5 bytes JMP 00000001002c0c0c
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                             0000000076ff55e2 5 bytes JMP 00000001002c0e10
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                    0000000076ff567c 5 bytes JMP 00000001002c01f8
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                    0000000076ff589f 5 bytes JMP 00000001002c03fc
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\SysWOW64\sechost.dll!DeleteService                                     0000000076ff5a22 5 bytes JMP 00000001002c0600
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                           0000000076831465 2 bytes [83, 76]
.text  C:\Users\Swift\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe[4660] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                          00000000768314bb 2 bytes [83, 76]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                       00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                           00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                            00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                        00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                            00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                    00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                                  0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                       00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                    0000000076ff5181 5 bytes JMP 0000000100101014
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                        0000000076ff5254 5 bytes JMP 0000000100100804
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                        0000000076ff53d5 3 bytes JMP 0000000100100a08
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW + 4                                                    0000000076ff53d9 1 byte [89]
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                       0000000076ff54c2 5 bytes JMP 0000000100100c0c
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                       0000000076ff55e2 5 bytes JMP 0000000100100e10
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                              0000000076ff567c 5 bytes JMP 00000001001001f8
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                              0000000076ff589f 5 bytes JMP 00000001001003fc
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                               0000000076ff5a22 5 bytes JMP 0000000100100600
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                              0000000076d3ee09 5 bytes JMP 00000001001101f8
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                               0000000076d43982 5 bytes JMP 00000001001103fc
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                            0000000076d47603 5 bytes JMP 0000000100110804
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                            0000000076d4835c 5 bytes JMP 0000000100110600
.text  C:\Program Files (x86)\Samsung\Kies\Kies.exe[4804] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                          0000000076d5f52b 5 bytes JMP 0000000100110a08
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory     00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory         00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess          00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory      00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread          00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                  00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112     00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\syswow64\USER32.dll!SetWinEventHook            0000000076d3ee09 5 bytes JMP 00000001001d01f8
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\syswow64\USER32.dll!UnhookWinEvent             0000000076d43982 5 bytes JMP 00000001001d03fc
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW          0000000076d47603 5 bytes JMP 00000001001d0804
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA          0000000076d4835c 5 bytes JMP 00000001001d0600
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx        0000000076d5f52b 5 bytes JMP 00000001001d0a08
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity  0000000076ff5181 5 bytes JMP 00000001001e1014
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA      0000000076ff5254 5 bytes JMP 00000001001e0804
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW      0000000076ff53d5 5 bytes JMP 00000001001e0a08
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A     0000000076ff54c2 5 bytes JMP 00000001001e0c0c
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W     0000000076ff55e2 5 bytes JMP 00000001001e0e10
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!CreateServiceA            0000000076ff567c 5 bytes JMP 00000001001e01f8
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!CreateServiceW            0000000076ff589f 5 bytes JMP 00000001001e03fc
.text  C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4868] C:\Windows\SysWOW64\sechost.dll!DeleteService             0000000076ff5a22 5 bytes JMP 00000001001e0600
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                        00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                            00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                             00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                         00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                             00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                     00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                   0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                        00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\syswow64\USER32.dll!SetWinEventHook                               0000000076d3ee09 5 bytes JMP 00000001002c01f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                0000000076d43982 5 bytes JMP 00000001002c03fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                             0000000076d47603 5 bytes JMP 00000001002c0804
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                             0000000076d4835c 5 bytes JMP 00000001002c0600
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                           0000000076d5f52b 5 bytes JMP 00000001002c0a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                     0000000076ff5181 5 bytes JMP 00000001002d1014
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                         0000000076ff5254 5 bytes JMP 00000001002d0804
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                         0000000076ff53d5 5 bytes JMP 00000001002d0a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                        0000000076ff54c2 5 bytes JMP 00000001002d0c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                        0000000076ff55e2 5 bytes JMP 00000001002d0e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                               0000000076ff567c 5 bytes JMP 00000001002d01f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                               0000000076ff589f 5 bytes JMP 00000001002d03fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe[4892] C:\Windows\SysWOW64\sechost.dll!DeleteService                                0000000076ff5a22 5 bytes JMP 00000001002d0600
.text  C:\Program Files\AVAST Software\Avast\AvastUI.exe[4900] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                  00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                              00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                  00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                   00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                               00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                   00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                           00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                         0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                              00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                     0000000076d3ee09 5 bytes JMP 00000001003c01f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                      0000000076d43982 5 bytes JMP 00000001003c03fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                   0000000076d47603 5 bytes JMP 00000001003c0804
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                   0000000076d4835c 5 bytes JMP 00000001003c0600
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                 0000000076d5f52b 5 bytes JMP 00000001003c0a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                           0000000076ff5181 5 bytes JMP 00000001003d1014
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                               0000000076ff5254 5 bytes JMP 00000001003d0804
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                               0000000076ff53d5 5 bytes JMP 00000001003d0a08
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                              0000000076ff54c2 5 bytes JMP 00000001003d0c0c
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                              0000000076ff55e2 5 bytes JMP 00000001003d0e10
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                     0000000076ff567c 5 bytes JMP 00000001003d01f8
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                     0000000076ff589f 5 bytes JMP 00000001003d03fc
.text  C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe[4936] C:\Windows\SysWOW64\sechost.dll!DeleteService                                      0000000076ff5a22 5 bytes JMP 00000001003d0600
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                   00000000774dfac0 5 bytes JMP 0000000100250600
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                       00000000774dfb58 5 bytes JMP 0000000100250804
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                        00000000774dfcb0 5 bytes JMP 0000000100250c0c
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    00000000774e0038 5 bytes JMP 0000000100250a08
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                        00000000774e1920 5 bytes JMP 0000000100250e10
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                00000000774fc4dd 5 bytes JMP 00000001002501f8
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                              0000000077501287 5 bytes JMP 00000001002503fc
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                   00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                0000000076ff5181 5 bytes JMP 0000000100261014
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                    0000000076ff5254 5 bytes JMP 0000000100260804
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                    0000000076ff53d5 5 bytes JMP 0000000100260a08
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                   0000000076ff54c2 5 bytes JMP 0000000100260c0c
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                   0000000076ff55e2 5 bytes JMP 0000000100260e10
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                          0000000076ff567c 5 bytes JMP 00000001002601f8
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                          0000000076ff589f 5 bytes JMP 00000001002603fc
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\SysWOW64\sechost.dll!DeleteService                                           0000000076ff5a22 5 bytes JMP 0000000100260600
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                          0000000076d3ee09 5 bytes JMP 00000001002701f8
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                           0000000076d43982 5 bytes JMP 00000001002703fc
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                        0000000076d47603 5 bytes JMP 0000000100270804
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                        0000000076d4835c 5 bytes JMP 0000000100270600
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4948] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                      0000000076d5f52b 5 bytes JMP 0000000100270a08
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                              00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                  00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                   00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                               00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                   00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                           00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                         0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                              00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                     0000000076d3ee09 5 bytes JMP 00000001001d01f8
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                      0000000076d43982 5 bytes JMP 00000001001d03fc
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                   0000000076d47603 5 bytes JMP 00000001001d0804
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                   0000000076d4835c 5 bytes JMP 00000001001d0600
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                 0000000076d5f52b 5 bytes JMP 00000001001d0a08
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                           0000000076ff5181 5 bytes JMP 0000000100261014
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                               0000000076ff5254 5 bytes JMP 0000000100260804
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                               0000000076ff53d5 5 bytes JMP 0000000100260a08
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                              0000000076ff54c2 5 bytes JMP 0000000100260c0c
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                              0000000076ff55e2 5 bytes JMP 0000000100260e10
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                     0000000076ff567c 5 bytes JMP 00000001002601f8
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                     0000000076ff589f 5 bytes JMP 00000001002603fc
.text  C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[4996] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                      0000000076ff5a22 5 bytes JMP 0000000100260600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                      00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                          00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                           00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                       00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                           00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                   00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                 0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                      00000000757da2ba 1 byte [62]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                             0000000076d3ee09 5 bytes JMP 00000001002401f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                              0000000076d43982 5 bytes JMP 00000001002403fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                           0000000076d47603 5 bytes JMP 0000000100240804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                           0000000076d4835c 5 bytes JMP 0000000100240600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                         0000000076d5f52b 5 bytes JMP 0000000100240a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                   0000000076ff5181 5 bytes JMP 0000000100251014
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                       0000000076ff5254 5 bytes JMP 0000000100250804
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                       0000000076ff53d5 5 bytes JMP 0000000100250a08
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                      0000000076ff54c2 5 bytes JMP 0000000100250c0c
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                      0000000076ff55e2 5 bytes JMP 0000000100250e10
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                             0000000076ff567c 5 bytes JMP 00000001002501f8
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                             0000000076ff589f 5 bytes JMP 00000001002503fc
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\SysWOW64\sechost.dll!DeleteService                                              0000000076ff5a22 5 bytes JMP 0000000100250600
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                    0000000076831465 2 bytes [83, 76]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5108] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                   00000000768314bb 2 bytes [83, 76]
.text  ...                                                                                                                                                            * 2
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory      00000000774dfac0 5 bytes JMP 0000000100030600
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory          00000000774dfb58 5 bytes JMP 0000000100030804
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess           00000000774dfcb0 5 bytes JMP 0000000100030c0c
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory       00000000774e0038 5 bytes JMP 0000000100030a08
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread           00000000774e1920 5 bytes JMP 0000000100030e10
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                   00000000774fc4dd 5 bytes JMP 00000001000301f8
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                 0000000077501287 5 bytes JMP 00000001000303fc
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112      00000000757da2ba 1 byte [62]
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\syswow64\user32.DLL!SetWinEventHook             0000000076d3ee09 5 bytes JMP 00000001002401f8
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\syswow64\user32.DLL!UnhookWinEvent              0000000076d43982 5 bytes JMP 00000001002403fc
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\syswow64\user32.DLL!SetWindowsHookExW           0000000076d47603 5 bytes JMP 0000000100240804
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\syswow64\user32.DLL!SetWindowsHookExA           0000000076d4835c 5 bytes JMP 0000000100240600
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\syswow64\user32.DLL!UnhookWindowsHookEx         0000000076d5f52b 5 bytes JMP 0000000100240a08
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity   0000000076ff5181 5 bytes JMP 0000000100261014
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA       0000000076ff5254 5 bytes JMP 0000000100260804
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW       0000000076ff53d5 5 bytes JMP 0000000100260a08
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A      0000000076ff54c2 5 bytes JMP 0000000100260c0c
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W      0000000076ff55e2 5 bytes JMP 0000000100260e10
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!CreateServiceA             0000000076ff567c 5 bytes JMP 00000001002601f8
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!CreateServiceW             0000000076ff589f 5 bytes JMP 00000001002603fc
.text  C:\Users\Swift\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gammacontrol.exe[4108] C:\Windows\SysWOW64\sechost.dll!DeleteService              0000000076ff5a22 5 bytes JMP 0000000100260600
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                               0000000077303b10 5 bytes JMP 00000001001c075c
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                 0000000077307ac0 5 bytes JMP 00000001001c03a4
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                    0000000077331430 5 bytes JMP 00000001001c0b14
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                        0000000077331490 5 bytes JMP 00000001001c0ecc
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000001001c163c
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                     00000000773317b0 5 bytes JMP 00000001001c1284
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 00000001001c19f4
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\System32\svchost.exe[4236] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                  000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                      000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                      000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                     000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                     000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                            000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                            000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\system32\sppsvc.exe[2324] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                             000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077331360 5 bytes JMP 0000000077490460
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000773313b0 5 bytes JMP 0000000077490450
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077331510 5 bytes JMP 0000000077490370
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077331560 5 bytes JMP 0000000077490470
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077331570 5 bytes JMP 00000000774903e0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077331620 5 bytes JMP 0000000077490320
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077331650 5 bytes JMP 00000000774903b0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077331670 5 bytes JMP 0000000077490390
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000773316b0 5 bytes JMP 00000000774902e0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077331730 5 bytes JMP 00000000774902d0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077331750 5 bytes JMP 0000000077490310
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077331790 5 bytes JMP 00000000774903c0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000773317e0 5 bytes JMP 00000000774903f0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077331940 5 bytes JMP 0000000077490230
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077331b00 5 bytes JMP 0000000077490480
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077331b30 5 bytes JMP 00000000774903a0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077331c10 5 bytes JMP 00000000774902f0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077331c20 5 bytes JMP 0000000077490350
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077331c80 5 bytes JMP 0000000077490290
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077331d10 5 bytes JMP 00000000774902b0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077331d30 5 bytes JMP 00000000774903d0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077331d40 5 bytes JMP 0000000077490330
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077331db0 5 bytes JMP 0000000077490410
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077331de0 5 bytes JMP 0000000077490240
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000773320a0 5 bytes JMP 00000000774901e0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077332160 5 bytes JMP 0000000077490250
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077332190 5 bytes JMP 0000000077490490
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000773321a0 5 bytes JMP 00000000774904a0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000773321d0 5 bytes JMP 0000000077490300
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000773321e0 5 bytes JMP 0000000077490360
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077332240 5 bytes JMP 00000000774902a0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077332290 5 bytes JMP 00000000774902c0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000773322c0 5 bytes JMP 0000000077490380
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000773322d0 5 bytes JMP 0000000077490340
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000773325c0 5 bytes JMP 0000000077490440
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000773327c0 5 bytes JMP 0000000077490260
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000773327d0 5 bytes JMP 0000000077490270
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773327e0 5 bytes JMP 0000000077490400
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000773329a0 5 bytes JMP 00000000774901f0
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000773329b0 5 bytes JMP 0000000077490210
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077332a20 5 bytes JMP 0000000077490200
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077332a80 5 bytes JMP 0000000077490420
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077332a90 5 bytes JMP 0000000077490430
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077332aa0 5 bytes JMP 0000000077490220
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077332b80 5 bytes JMP 0000000077490280
.text  C:\Windows\system32\AUDIODG.EXE[3664] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                                                    000000007721eecd 1 byte [62]
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                 000007fefe4c6e00 5 bytes JMP 000007ff7e4e1dac
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                     000007fefe4c6f2c 5 bytes JMP 000007ff7e4e0ecc
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                     000007fefe4c7220 5 bytes JMP 000007ff7e4e1284
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                    000007fefe4c739c 5 bytes JMP 000007ff7e4e163c
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                    000007fefe4c7538 5 bytes JMP 000007ff7e4e19f4
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                           000007fefe4c75e8 5 bytes JMP 000007ff7e4e03a4
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                           000007fefe4c790c 5 bytes JMP 000007ff7e4e075c
.text  C:\Windows\System32\svchost.exe[4612] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                            000007fefe4c7ab4 5 bytes JMP 000007ff7e4e0b14
.text  C:\Users\Swift\Desktop\gmer_2.1.19163.exe[3112] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112

TattooPanda · 14.09.2013, 19:23

und der Rest des GMER Logs.

vielen Dank schonmal für die Mühe

Code:

ATTFilter

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type                                                                                                           2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start                                                                                                          2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl                                                                                                   1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName                                                                                                    aswFsBlk
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group                                                                                                          FSFilter Activity Monitor
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService                                                                                                FltMgr?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description                                                                                                    avast! mini-filter driver (aswFsBlk)
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag                                                                                                            2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances                                                                                                      
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance                                                                                      aswFsBlk Instance
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance                                                                                    
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                           388400
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                              0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk                                                                                                                
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type                                                                                                          2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start                                                                                                         2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl                                                                                                  1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath                                                                                                     \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName                                                                                                   aswMonFlt
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group                                                                                                         FSFilter Anti-Virus
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService                                                                                               FltMgr?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description                                                                                                   avast! mini-filter driver (aswMonFlt)
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances                                                                                                     
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance                                                                                     aswMonFlt Instance
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance                                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                         320700
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                            0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt                                                                                                               
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath                                                                                                        \SystemRoot\System32\Drivers\aswrdr2.sys
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type                                                                                                             1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start                                                                                                            1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl                                                                                                     1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName                                                                                                      aswRdr
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group                                                                                                            PNP_TDI
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService                                                                                                  tcpip?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description                                                                                                      avast! WFP Redirect driver
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters                                                                                                       
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                                    
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                                    nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr                                                                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type                                                                                                            1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start                                                                                                           0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl                                                                                                    1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName                                                                                                     aswRvrt
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description                                                                                                     avast! Revert
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters                                                                                                      
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter                                                                                          60
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter                                                                                          852008
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot                                                                                           \Device\Harddisk0\Partition2\Windows
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown                                                                                     1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt                                                                                                                 
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type                                                                                                             2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start                                                                                                            1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl                                                                                                     1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName                                                                                                      aswSnx
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group                                                                                                            FSFilter Virtualization
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService                                                                                                  FltMgr?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description                                                                                                      avast! virtualization driver (aswSnx)
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag                                                                                                              2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances                                                                                                        
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance                                                                                        aswSnx Instance
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance                                                                                        
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                               137600
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags                                                                                  0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters                                                                                                       
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder                                                                                         \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder                                                                                            \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx                                                                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type                                                                                                              1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start                                                                                                             1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl                                                                                                      1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName                                                                                                       aswSP
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description                                                                                                       avast! Self Protection
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters                                                                                                        
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield                                                                                            1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder                                                                                          \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder                                                                                             \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder                                                                                     \DosDevices\C:\Program Files
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder                                                                                           \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP                                                                                                                   
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type                                                                                                             1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start                                                                                                            1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl                                                                                                     1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName                                                                                                      avast! Network Shield Support
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group                                                                                                            PNP_TDI
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService                                                                                                  tcpip?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description                                                                                                      avast! Network Shield TDI driver
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag                                                                                                              9
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi                                                                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type                                                                                                             1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start                                                                                                            0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl                                                                                                     1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName                                                                                                      aswVmm
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description                                                                                                      avast! VM Monitor
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters                                                                                                       
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm                                                                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type                                                                                                   32
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start                                                                                                  2
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl                                                                                           1
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath                                                                                              "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName                                                                                            avast! Antivirus
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group                                                                                                  ShellSvcGroup
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService                                                                                        aswMonFlt?RpcSS?
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64                                                                                                  1
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName                                                                                             LocalSystem
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType                                                                                         1
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description                                                                                            Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus                                                                                                        
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type                                                                                                               2
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start                                                                                                              2
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl                                                                                                       1
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName                                                                                                        aswFsBlk
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group                                                                                                              FSFilter Activity Monitor
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService                                                                                                    FltMgr?
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description                                                                                                        avast! mini-filter driver (aswFsBlk)
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag                                                                                                                2
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)                                                                                  
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance                                                                                          aswFsBlk Instance
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)                                                                
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                               388400
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                                  0
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type                                                                                                              2
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start                                                                                                             2
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl                                                                                                      1
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath                                                                                                         \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName                                                                                                       aswMonFlt
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group                                                                                                             FSFilter Anti-Virus
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService                                                                                                   FltMgr?
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description                                                                                                       avast! mini-filter driver (aswMonFlt)
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)                                                                                 
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance                                                                                         aswMonFlt Instance
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)                                                              
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                             320700
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                                0
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath                                                                                                            \SystemRoot\System32\Drivers\aswrdr2.sys
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Type                                                                                                                 1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Start                                                                                                                1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl                                                                                                         1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName                                                                                                          aswRdr
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Group                                                                                                                PNP_TDI
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService                                                                                                      tcpip?
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Description                                                                                                          avast! WFP Redirect driver
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)                                                                                   
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                                        
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                                        nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type                                                                                                                1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start                                                                                                               0
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl                                                                                                        1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName                                                                                                         aswRvrt
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description                                                                                                         avast! Revert
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)                                                                                  
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter                                                                                              60
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter                                                                                              852008
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot                                                                                               \Device\Harddisk0\Partition2\Windows
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown                                                                                         1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Type                                                                                                                 2
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Start                                                                                                                1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl                                                                                                         1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName                                                                                                          aswSnx
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Group                                                                                                                FSFilter Virtualization
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService                                                                                                      FltMgr?
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Description                                                                                                          avast! virtualization driver (aswSnx)
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag                                                                                                                  2
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)                                                                                    
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance                                                                                            aswSnx Instance
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)                                                                    
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                                   137600
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags                                                                                      0
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)                                                                                   
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder                                                                                             \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder                                                                                                \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@Type                                                                                                                  1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@Start                                                                                                                 1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl                                                                                                          1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName                                                                                                           aswSP
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@Description                                                                                                           avast! Self Protection
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)                                                                                    
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield                                                                                                1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder                                                                                              \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder                                                                                                 \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder                                                                                         \DosDevices\C:\Program Files
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder                                                                                               \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Type                                                                                                                 1
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Start                                                                                                                1
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl                                                                                                         1
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName                                                                                                          avast! Network Shield Support
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Group                                                                                                                PNP_TDI
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService                                                                                                      tcpip?
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Description                                                                                                          avast! Network Shield TDI driver
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag                                                                                                                  9
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@Type                                                                                                                 1
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@Start                                                                                                                0
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl                                                                                                         1
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName                                                                                                          aswVmm
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@Description                                                                                                          avast! VM Monitor
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)                                                                                   
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type                                                                                                       32
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start                                                                                                      2
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl                                                                                               1
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath                                                                                                  "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName                                                                                                avast! Antivirus
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group                                                                                                      ShellSvcGroup
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService                                                                                            aswMonFlt?RpcSS?
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64                                                                                                      1
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName                                                                                                 LocalSystem
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType                                                                                             1
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description                                                                                                Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.

---- EOF - GMER 2.1 ----

schrauber · 15.09.2013, 10:11

sieht alles gut aus

TattooPanda · 15.09.2013, 12:10

Also viel Lärm um nichts?

schrauber · 15.09.2013, 15:55

genau

15.09.2013, 10:11	#13
schrauber /// the machine /// TB-Ausbilder	Windows 7: UDP Flood aus meinem Netzwerk, Trojaner? sieht alles gut aus __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

15.09.2013, 15:55	#15
schrauber /// the machine /// TB-Ausbilder	Windows 7: UDP Flood aus meinem Netzwerk, Trojaner? genau __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 7: UDP Flood aus meinem Netzwerk, Trojaner?

Log-Analyse und Auswertung: Windows 7: UDP Flood aus meinem Netzwerk, Trojaner?