Hallo,
ich habe seit ein paar Tage kommische Popup Fenster in allen Browser, die ich verwende.
Ich habe alle Browser schon auf Grundeinstellungen gesetzt, Spybot mehrmals laufen lassen, danach Malwarebytes, AdwCleaner und HitmanPro, ich kriege sie aber nicht weg. Die erscheinen nicht überall, und auch nicht auf alle Seiten sondern ab und zu, auf seiten wie Vimeo, oder irgendwelche Blogs. Es sind meistens Webungssteiten, aber auch ab und zu solche mit gefährlichen Inhalt (laut Avast). Hier sind die Logs, die ich erstellt habe.
Vielen Dank für eure Hilfe im Voraus!

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:22 on 07/11/2014 (SiXidE)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-11-2014
Ran by SiXidE (administrator) on SIXIDE-PC on 07-11-2014 23:36:47
Running from C:\Users\SiXidE\Downloads
Loaded Profile: SiXidE (Available profiles: SiXidE)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Razer Inc.) C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Razer Inc.) C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Autodesk Inc.) C:\Users\SiXidE\AppData\Local\Autodesk\.AdskAppManager\R1\AdAppMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_25\bin\javaw.exe
(Visicom Media Inc.) C:\Program Files (x86)\ManyCam\ManyCam.exe
(TechSmith Corporation) D:\programme\Camtasia\CamtasiaStudio.exe
(TechSmith Corporation) D:\programme\Camtasia\TscHelp.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-02] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613536 2010-10-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-09-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5223016 2014-10-31] (AVAST Software)
HKLM-x32\...\Run: [RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe [254464 2014-05-20] (Razer Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [585536 2014-09-29] (Razer Inc.)
HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [477064 2013-12-22] (Autodesk Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2011-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [2904984 2011-09-05] (Adobe Systems Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2053263401-3595949893-2862785971-1000\...\Run: [SplitCam] => C:\Program Files (x86)\SplitCam\SplitCam.exe
HKU\S-1-5-21-2053263401-3595949893-2862785971-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2053263401-3595949893-2862785971-1000\...\MountPoints2: {a0f0ebb4-5c2e-11e4-acf6-806e6f6e6963} - G:\.\Bin\ASSETUP.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-10-25] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF72378F454F9CF01
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\SiXidE\AppData\Roaming\Mozilla\Firefox\Profiles\2xz98s2r.default-1415348950839
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-10-30]

Chrome: 
=======
CHR Profile: C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-31]
CHR Extension: (Google Docs) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-31]
CHR Extension: (Google Drive) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-31]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-02]
CHR Extension: (YouTube) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-31]
CHR Extension: (Google-Suche) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-31]
CHR Extension: (Google Tabellen) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-31]
CHR Extension: (Avast Online Security) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-10-31]
CHR Extension: (Google Wallet) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-31]
CHR Extension: (Google Mail) - C:\Users\SiXidE\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-31]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-10-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [576904 2013-12-22] (Autodesk Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-25] (AVAST Software)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 mi-raysat_3dsmax2015_64; C:\Program Files\Autodesk\3ds Max 2015\NVIDIA\Satellite\raysat_3dsmax2015_64server.exe [86016 2011-09-15] () [File not signed]
R2 RzWizardService; C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe [367616 2014-05-20] (Razer Inc.) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [649496 2014-10-27] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-10-25] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-10-31] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-10-25] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-10-25] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-10-31] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-10-25] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-10-25] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-10-25] ()
R3 hxctlflt; C:\Windows\System32\DRIVERS\hxctlflt.sys [111104 2009-02-09] (Guillemot Corporation)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49264 2014-07-28] (Visicom Media Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35440 2014-05-13] (Visicom Media Inc.)
R3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527360 2007-09-10] (PixArt Imaging Inc.)
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39592 2014-09-05] (Razer Inc)
S3 scvad_simple; C:\Windows\System32\drivers\SplitCamAudio.sys [23552 2013-04-24] (Windows (R) Win 7 DDK provider)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-07 23:36 - 2014-11-07 23:36 - 02114560 _____ (Farbar) C:\Users\SiXidE\Downloads\FRST64.exe
2014-11-07 23:36 - 2014-11-07 23:36 - 00018342 _____ () C:\Users\SiXidE\Downloads\FRST.txt
2014-11-07 23:36 - 2014-11-07 23:36 - 00000000 ____D () C:\FRST
2014-11-07 23:22 - 2014-11-07 23:22 - 00000474 _____ () C:\Users\SiXidE\Downloads\defogger_disable.log
2014-11-07 23:22 - 2014-11-07 23:22 - 00000000 _____ () C:\Users\SiXidE\defogger_reenable
2014-11-07 23:20 - 2014-11-07 23:20 - 00050477 _____ () C:\Users\SiXidE\Downloads\Defogger.exe
2014-11-07 12:09 - 2014-11-07 12:09 - 00000000 ___RD () C:\Users\SiXidE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-11-07 10:14 - 2014-11-07 10:14 - 00000000 ____D () C:\Users\SiXidE\Desktop\camera
2014-11-07 01:24 - 2014-11-07 01:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-07 00:41 - 2014-11-07 00:42 - 00133192 _____ () C:\Users\SiXidE\Downloads\spideraysfonts_rosetta-stone.zip
2014-11-07 00:40 - 2014-11-07 00:40 - 00037715 _____ () C:\Users\SiXidE\Downloads\ancient_egyptian_hieroglyphs.zip
2014-11-06 21:18 - 2014-11-06 21:18 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\WTablet
2014-11-06 21:00 - 2014-11-06 21:00 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom Tablett
2014-11-06 21:00 - 2014-11-06 21:00 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wacomrouterfilter_01009.Wdf
2014-11-06 21:00 - 2014-11-06 21:00 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wachidrouter_01009.Wdf
2014-11-06 21:00 - 2014-11-06 21:00 - 00000000 ____D () C:\Program Files\TabletPlugins
2014-11-06 21:00 - 2014-11-06 21:00 - 00000000 ____D () C:\Program Files (x86)\TabletPlugins
2014-11-06 21:00 - 2014-08-06 19:15 - 00102200 _____ (Wacom Technology) C:\Windows\system32\Drivers\wachidrouter.sys
2014-11-06 21:00 - 2014-08-06 19:15 - 00015160 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys
2014-11-06 21:00 - 2014-08-06 19:15 - 00014136 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys
2014-11-06 21:00 - 2012-12-11 23:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wdfcoinstaller01009.dll
2014-11-06 20:59 - 2014-11-06 21:00 - 00000000 ____D () C:\Program Files\Tablet
2014-11-06 20:59 - 2014-10-27 22:38 - 02005784 _____ (Wacom Technology, Corp.) C:\Windows\system32\WacomMT.dll
2014-11-06 20:59 - 2014-10-27 22:38 - 01989912 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.dll
2014-11-06 20:59 - 2014-10-27 22:38 - 01983256 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Touch_Tablet.dll
2014-11-06 20:59 - 2014-10-27 22:38 - 01856792 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wintab32.dll
2014-11-06 20:59 - 2014-10-27 22:38 - 01613080 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Tablet.dll
2014-11-06 20:59 - 2014-10-27 22:38 - 01608984 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\WacomMT.dll
2014-11-06 20:59 - 2014-10-27 22:38 - 01605912 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Touch_Tablet.dll
2014-11-06 20:59 - 2014-10-27 22:38 - 01492248 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wintab32.dll
2014-11-06 20:57 - 2014-11-06 20:58 - 109275864 _____ () C:\Users\SiXidE\Downloads\WacomTablet_6.3.9w5.exe
2014-11-06 12:47 - 2014-11-07 00:24 - 00000000 ____D () C:\Users\SiXidE\Desktop\cheops
2014-11-06 01:12 - 2014-11-06 01:12 - 00001354 _____ () C:\Users\SiXidE\Desktop\JRT.txt
2014-11-06 01:08 - 2014-11-06 01:08 - 01706939 _____ (Thisisu) C:\Users\SiXidE\Downloads\JRT.exe
2014-11-06 01:08 - 2014-11-06 01:08 - 00000000 ____D () C:\Windows\ERUNT
2014-11-06 01:04 - 2014-11-07 10:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-06 01:04 - 2014-11-06 01:04 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-06 01:04 - 2014-11-06 01:04 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-06 01:03 - 2014-11-06 01:03 - 00244392 _____ () C:\Users\SiXidE\Downloads\Firefox Setup Stub 33.0.2.exe
2014-11-05 21:01 - 2014-11-05 21:01 - 05432987 _____ () C:\Users\SiXidE\Downloads\Isis_s1.skp
2014-11-05 18:16 - 2014-11-05 18:17 - 12309282 _____ () C:\Users\SiXidE\Downloads\Style of ancient Egyptian sculpture.rar
2014-11-05 16:18 - 2014-11-05 16:18 - 00297341 _____ () C:\Users\SiXidE\Downloads\67tutankhamun.zip
2014-11-05 16:09 - 2014-11-05 16:09 - 09304642 _____ () C:\Users\SiXidE\Downloads\Isis_2-_sf.skp
2014-11-05 16:09 - 2014-11-05 16:09 - 05670223 _____ () C:\Users\SiXidE\Downloads\Bastet_xs.skp
2014-11-05 16:08 - 2014-11-05 16:08 - 03439723 _____ () C:\Users\SiXidE\Downloads\Anubis_ns.skp
2014-11-05 16:01 - 2014-11-05 16:01 - 02655113 _____ () C:\Users\SiXidE\Downloads\2e56694a594aa52c0559eb700e432e15.zip
2014-11-05 15:59 - 2014-11-05 15:59 - 00703074 _____ () C:\Users\SiXidE\Downloads\c8583b5b45561bd4aba12d5d414530ae.rar
2014-11-05 15:58 - 2014-11-05 15:58 - 00542555 _____ () C:\Users\SiXidE\Downloads\c575afb86a2a22c8b1c84dedbd7911b4.rar
2014-11-05 15:55 - 2014-11-05 15:55 - 02681700 _____ () C:\Users\SiXidE\Downloads\ab7c0b99a2628239a6f4b92b1caf7d18.zip
2014-11-05 15:54 - 2014-11-05 15:54 - 01813773 _____ () C:\Users\SiXidE\Downloads\db2a098b14e197bc3c8e69c4c526909f.rar
2014-11-05 14:41 - 2014-11-05 14:45 - 57863344 _____ () C:\Users\SiXidE\Downloads\flare3d 2.7.1.zip
2014-11-04 20:01 - 2014-11-04 20:01 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-11-04 20:01 - 2014-11-04 20:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-04 20:01 - 2014-11-04 20:01 - 00000000 ____D () C:\Program Files (x86)\Java
2014-11-04 19:58 - 2014-11-04 19:58 - 11394865 _____ () C:\Users\SiXidE\Downloads\CheopsControls-captive-runtime.apk
2014-11-04 19:55 - 2014-11-04 19:55 - 00638888 _____ (Oracle Corporation) C:\Users\SiXidE\Downloads\jxpiinstall(2).exe
2014-11-04 19:00 - 2014-11-04 19:05 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-11-04 18:59 - 2014-11-04 18:59 - 11222744 _____ (SurfRight B.V.) C:\Users\SiXidE\Downloads\HitmanPro_x64.exe
2014-11-04 17:49 - 2014-11-07 10:05 - 00000000 ____D () C:\AdwCleaner
2014-11-04 17:49 - 2014-11-04 17:49 - 01998336 _____ () C:\Users\SiXidE\Downloads\AdwCleaner_4.002.exe
2014-11-04 17:48 - 2014-11-04 17:48 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-11-04 11:37 - 2014-11-07 22:45 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-04 11:37 - 2014-11-04 11:37 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-04 11:37 - 2014-11-04 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-04 11:37 - 2014-11-04 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-04 11:37 - 2014-11-04 11:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-11-04 11:37 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-04 11:37 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-04 11:37 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-04 11:36 - 2014-11-04 11:37 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\SiXidE\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-02 22:49 - 2014-11-07 09:29 - 00000000 ____D () C:\Users\SiXidE\Desktop\Alte Firefox-Daten
2014-11-02 18:29 - 2014-11-02 18:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-11-02 10:53 - 2014-11-07 12:35 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\CrashDumps
2014-11-02 10:11 - 2014-11-02 10:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-11-02 10:10 - 2014-11-02 10:10 - 00000000 ____D () C:\Windows\PCHEALTH
2014-11-02 10:10 - 2014-11-02 10:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-11-02 10:10 - 2014-11-02 10:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-11-02 10:09 - 2014-11-02 10:09 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-11-02 10:09 - 2014-11-02 10:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-11-02 10:08 - 2014-11-02 10:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-02 10:08 - 2014-11-02 10:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-11-02 10:08 - 2014-11-02 10:08 - 00000000 __RHD () C:\MSOCache
2014-11-02 10:08 - 2014-11-02 10:08 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Microsoft Help
2014-11-01 20:30 - 2014-11-01 20:30 - 00000000 ____D () C:\Users\SiXidE\dwhelper
2014-10-31 18:15 - 2014-11-06 01:02 - 00000000 ____D () C:\Program Files (x86)\Google
2014-10-31 18:15 - 2014-10-31 18:16 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Google
2014-10-31 18:14 - 2014-10-31 18:15 - 00880272 _____ (Google Inc.) C:\Users\SiXidE\Downloads\ChromeSetup.exe
2014-10-31 17:23 - 2014-10-31 17:23 - 00000000 __SHD () C:\Users\SiXidE\AppData\Local\EmieUserList
2014-10-31 17:23 - 2014-10-31 17:23 - 00000000 __SHD () C:\Users\SiXidE\AppData\Local\EmieSiteList
2014-10-31 15:34 - 2014-10-31 15:34 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Media Player Classic
2014-10-31 12:07 - 2014-10-31 12:08 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Yahoo!
2014-10-31 12:07 - 2014-10-31 12:07 - 00001141 _____ () C:\Users\Public\Desktop\Yahoo! Messenger.lnk
2014-10-31 12:07 - 2014-10-31 12:07 - 00000000 ____D () C:\ProgramData\Yahoo! Companion
2014-10-31 12:07 - 2014-10-31 12:07 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-10-31 12:07 - 2014-10-31 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
2014-10-31 12:06 - 2014-10-31 12:07 - 00000000 ____D () C:\Program Files (x86)\Yahoo!
2014-10-31 12:04 - 2014-10-31 12:04 - 00693424 _____ (Yahoo! Inc.) C:\Users\SiXidE\Downloads\msgr11de.exe
2014-10-31 10:45 - 2014-10-31 17:40 - 00000000 ____D () C:\Users\SiXidE\Desktop\fun
2014-10-31 09:45 - 2014-11-07 12:39 - 00007680 _____ () C:\Users\SiXidE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-10-30 13:17 - 2014-10-30 13:17 - 00003506 _____ () C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-SiXidE-PC-SiXidE
2014-10-30 13:17 - 2014-10-30 13:17 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\AMD
2014-10-30 13:15 - 2014-10-30 13:17 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2014-10-30 13:05 - 2014-10-30 13:05 - 00000000 ____D () C:\ProgramData\ALM
2014-10-30 13:04 - 2014-10-30 13:04 - 00000000 ____D () C:\Users\SiXidE\Adobe Flash Builder 4.6
2014-10-30 13:03 - 2014-10-30 13:03 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2014-10-30 13:03 - 2014-10-30 13:03 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
2014-10-30 13:03 - 2014-10-30 13:03 - 00002026 _____ () C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2014-10-30 13:03 - 2014-10-30 13:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
2014-10-30 13:02 - 2014-10-30 13:02 - 00001097 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Widget Browser.lnk
2014-10-30 13:02 - 2014-10-30 13:02 - 00000000 ____D () C:\Program Files (x86)\My Company Name
2014-10-30 13:02 - 2011-11-03 03:01 - 00056208 ____N (Rovi Corporation) C:\Windows\system32\Drivers\PxHlpa64.sys
2014-10-30 13:02 - 2011-10-17 03:00 - 00010224 ____N (Sonic Solutions) C:\Windows\system32\Drivers\cdralw2k.sys
2014-10-30 13:02 - 2011-10-17 03:00 - 00010224 ____N (Sonic Solutions) C:\Windows\system32\Drivers\cdr4_xp.sys
2014-10-30 13:01 - 2014-10-30 13:01 - 00000997 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2014-10-30 13:01 - 2014-10-30 13:01 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-10-30 13:01 - 2014-10-30 13:01 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-10-30 13:00 - 2014-10-30 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Master Collection CS6
2014-10-30 13:00 - 2014-10-30 13:07 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-30 13:00 - 2014-10-30 13:06 - 00000000 ____D () C:\Program Files\Adobe
2014-10-30 13:00 - 2014-10-30 13:05 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-10-30 12:57 - 2014-10-31 08:43 - 00000000 ____D () C:\ProgramData\Adobe
2014-10-30 12:10 - 2014-10-30 12:12 - 00000200 _____ () C:\Users\SiXidE\Documents\Autodesk 3ds Max Setup Launcher.html
2014-10-30 11:58 - 2014-11-07 09:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-10-30 11:58 - 2014-10-30 12:34 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-10-30 11:58 - 2014-10-30 11:58 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-10-30 11:58 - 2014-10-30 11:58 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-10-30 11:58 - 2014-10-30 11:58 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-10-30 11:58 - 2014-10-30 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-10-30 11:58 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-10-30 11:57 - 2014-10-30 11:57 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\SiXidE\Downloads\spybot-2.4.exe
2014-10-30 11:28 - 2014-10-30 11:28 - 00001027 _____ () C:\Users\Public\Desktop\ManyCam.lnk
2014-10-30 11:28 - 2014-10-30 11:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ManyCam
2014-10-30 11:27 - 2014-10-30 11:29 - 00000000 ____D () C:\ProgramData\ManyCam
2014-10-30 11:21 - 2013-04-24 09:45 - 00810496 _____ () C:\Windows\SysWOW64\xvidcore.dll
2014-10-30 11:21 - 2013-04-24 09:45 - 00183808 _____ () C:\Windows\SysWOW64\xvidvfw.dll
2014-10-30 11:21 - 2013-04-24 09:45 - 00080896 _____ () C:\Windows\SysWOW64\ff_vfw.dll
2014-10-30 11:21 - 2013-04-24 09:45 - 00000590 _____ () C:\Windows\SysWOW64\ff_vfw.dll.manifest
2014-10-30 11:17 - 2014-10-31 09:35 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\ManyCam
2014-10-30 11:17 - 2014-10-30 11:28 - 00000000 ____D () C:\Program Files (x86)\ManyCam
2014-10-30 11:17 - 2014-10-30 11:27 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\ManyCam
2014-10-29 18:20 - 2014-10-30 00:19 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\FileZilla
2014-10-29 00:17 - 2014-10-29 00:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chaos Group
2014-10-29 00:17 - 2014-10-29 00:17 - 00000000 ____D () C:\Program Files\Common Files\ChaosGroup
2014-10-29 00:17 - 2014-10-29 00:17 - 00000000 ____D () C:\Program Files\Chaos Group
2014-10-27 08:06 - 2014-10-27 08:06 - 00000000 ____D () C:\Users\SiXidE\Documents\Camtasia Studio
2014-10-27 08:06 - 2014-10-27 08:06 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\TechSmith
2014-10-27 08:06 - 2014-10-27 08:06 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\TechSmith
2014-10-27 00:41 - 2014-10-27 00:41 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\WinRAR
2014-10-27 00:40 - 2014-10-27 00:40 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-10-27 00:40 - 2014-10-27 00:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-10-27 00:39 - 2014-10-27 00:40 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-10-27 00:39 - 2014-10-27 00:39 - 01857192 _____ () C:\Users\SiXidE\Downloads\wrar511d.exe
2014-10-26 23:09 - 2014-10-26 23:09 - 00000688 _____ () C:\Users\Public\Desktop\Camtasia Studio 8.lnk
2014-10-26 23:09 - 2014-10-26 23:09 - 00000000 ____D () C:\ProgramData\TechSmith
2014-10-26 23:09 - 2014-10-26 23:09 - 00000000 ____D () C:\ProgramData\regid.1995-08.com.techsmith
2014-10-26 23:09 - 2014-10-26 23:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith
2014-10-26 23:09 - 2014-10-26 23:09 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-10-26 23:05 - 2014-10-26 23:05 - 00000570 _____ () C:\Users\Public\Documents\bitrock_installer_5376.log
2014-10-26 23:05 - 2014-10-26 23:05 - 00000000 ____D () C:\Users\Public\Documents\ZBrushData
2014-10-26 23:04 - 2014-10-26 23:04 - 00001177 _____ () C:\Users\Public\Desktop\ZBrush 4R6.lnk
2014-10-26 23:04 - 2014-10-26 23:04 - 00000000 ____D () C:\Users\Public\Pixologic
2014-10-26 23:04 - 2014-10-26 23:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pixologic
2014-10-26 23:03 - 2014-10-26 23:03 - 00000000 ____D () C:\Program Files (x86)\Pixologic
2014-10-26 22:16 - 2014-10-26 22:16 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-10-26 09:53 - 2014-10-26 09:53 - 00000000 ____D () C:\Users\SiXidE\Documents\Direct Connect
2014-10-26 09:52 - 2014-10-26 09:52 - 00000000 ____D () C:\Program Files (x86)\Autodesk
2014-10-26 09:50 - 2014-10-30 12:12 - 00001966 _____ () C:\Users\Public\Desktop\3ds Max 2015.lnk
2014-10-26 09:50 - 2014-10-26 09:50 - 00000000 ____D () C:\Program Files\Common Files\Macrovision Shared
2014-10-26 09:48 - 2014-10-29 00:11 - 00000000 ____D () C:\Users\SiXidE\Documents\3dsMax
2014-10-26 09:48 - 2014-10-26 09:48 - 00000000 ____D () C:\Program Files\Autodesk
2014-10-26 09:47 - 2014-10-26 22:16 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Autodesk
2014-10-26 09:47 - 2014-10-26 09:52 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2014-10-26 09:47 - 2014-10-26 09:47 - 00000000 ____D () C:\Users\SiXidE\Documents\Autodesk Application Manager
2014-10-26 09:46 - 2014-10-30 12:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2014-10-26 09:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-10-26 09:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-10-26 09:46 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-10-26 09:46 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-10-26 09:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-10-26 09:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-10-26 09:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-10-26 09:38 - 2014-10-29 00:12 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Autodesk
2014-10-26 09:38 - 2014-10-29 00:11 - 00000000 ____D () C:\ProgramData\Autodesk
2014-10-26 08:57 - 2014-10-26 08:57 - 00000000 ____D () C:\Neuer Ordner
2014-10-25 20:52 - 2014-10-25 20:52 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\MPC-HC
2014-10-25 20:40 - 2014-10-25 20:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-10-25 20:40 - 2014-10-25 20:40 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-10-25 20:40 - 2013-08-22 18:09 - 00256088 _____ () C:\Windows\system32\unrar64.dll
2014-10-25 20:40 - 2013-08-22 18:09 - 00217176 _____ () C:\Windows\SysWOW64\unrar.dll
2014-10-25 20:34 - 2014-10-25 20:34 - 00001444 _____ () C:\Users\SiXidE\Desktop\ShadowOfMordor - Verknüpfung.lnk
2014-10-25 20:18 - 2014-10-25 20:18 - 00000000 ____D () C:\Users\SiXidE\Documents\WB Games
2014-10-25 20:18 - 2014-10-25 20:18 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Steam
2014-10-25 14:50 - 2014-10-25 14:50 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Razer_Inc
2014-10-25 14:50 - 2014-10-25 14:50 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Razer
2014-10-25 14:48 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-25 14:48 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-25 14:48 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-25 14:48 - 2014-05-08 10:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-10-25 14:43 - 2014-10-25 14:43 - 00063958 _____ () C:\Windows\DPINST.LOG
2014-10-25 14:43 - 2014-10-25 14:43 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_rzudd_01009.Wdf
2014-10-25 14:43 - 2014-10-25 14:43 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_rzendpt_01009.Wdf
2014-10-25 14:42 - 2014-10-25 14:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-10-25 14:38 - 2014-10-25 14:38 - 00003118 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2014-10-25 14:38 - 2014-10-25 14:38 - 00003092 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2014-10-25 14:38 - 2014-10-25 14:38 - 00003090 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2014-10-25 14:38 - 2014-10-25 14:38 - 00003062 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe
2014-10-25 14:38 - 2014-10-25 14:38 - 00003060 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe
2014-10-25 14:38 - 2014-10-25 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus- und Tastatur-Center
2014-10-25 14:37 - 2014-10-25 14:43 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-10-25 14:37 - 2014-10-25 14:37 - 00000000 ____D () C:\ProgramData\Razer
2014-10-25 14:37 - 2014-10-25 14:37 - 00000000 ____D () C:\Program Files\Microsoft Mouse and Keyboard Center
2014-10-25 14:37 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-10-25 14:37 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-10-25 14:37 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-10-25 14:37 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-10-25 14:37 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-10-25 14:37 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-25 14:37 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-10-25 14:37 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-10-25 14:37 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-10-25 14:37 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-10-25 14:37 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-10-25 14:37 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-10-25 14:37 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-25 14:37 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-25 14:37 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-10-25 14:37 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-25 14:37 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-10-25 14:37 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-10-25 14:37 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-10-25 14:37 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-10-25 14:31 - 2014-06-27 03:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-10-25 14:31 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-10-25 14:30 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-25 14:30 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-25 14:30 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-25 14:30 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-25 14:30 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-25 14:30 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-25 14:30 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-25 14:30 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-25 14:30 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-25 14:30 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-25 14:30 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-25 14:30 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-25 14:30 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-25 14:30 - 2014-06-24 04:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-10-25 14:30 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-10-25 14:30 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-10-25 14:30 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-10-25 14:30 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-10-25 14:30 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-10-25 14:30 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-10-25 14:30 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-10-25 14:30 - 2012-07-06 21:07 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2014-10-25 14:30 - 2012-02-11 07:36 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2014-10-25 14:30 - 2012-02-11 07:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2014-10-25 14:30 - 2011-04-28 04:54 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BTHUSB.SYS
2014-10-25 14:30 - 2011-03-11 07:41 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2014-10-25 14:30 - 2011-03-11 07:41 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2014-10-25 14:30 - 2011-03-11 07:41 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2014-10-25 14:30 - 2011-03-11 07:41 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2014-10-25 14:30 - 2011-03-11 07:41 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2014-10-25 14:30 - 2011-03-11 07:33 - 02565632 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2014-10-25 14:30 - 2011-03-11 07:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2014-10-25 14:30 - 2011-03-11 06:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2014-10-25 14:30 - 2011-03-11 06:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
2014-10-25 14:30 - 2011-03-11 05:37 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-10-25 14:30 - 2011-02-25 07:19 - 02871808 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-10-25 14:30 - 2011-02-25 06:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2014-10-25 14:20 - 2014-10-25 14:20 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-10-25 14:13 - 2014-10-25 14:13 - 00003144 _____ () C:\Windows\System32\Tasks\{4B5C6724-5977-45F6-AF8C-6D3BB133B5C5}
2014-10-25 14:03 - 2014-10-25 14:03 - 00638888 _____ (Oracle Corporation) C:\Users\SiXidE\Downloads\jxpiinstall(1).exe
2014-10-25 14:02 - 2014-11-04 20:01 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-25 14:02 - 2014-10-25 14:02 - 00000000 ____D () C:\ProgramData\Sun
2014-10-25 14:02 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-25 14:02 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-25 14:02 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-10-25 14:02 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-10-25 14:01 - 2014-10-25 14:01 - 00638888 _____ (Oracle Corporation) C:\Users\SiXidE\Downloads\jxpiinstall.exe
2014-10-25 13:49 - 2013-10-14 17:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2014-10-25 13:46 - 2014-11-04 16:10 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Adobe
2014-10-25 13:46 - 2014-10-25 13:46 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Macromedia
2014-10-25 13:46 - 2014-10-25 13:46 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Macromedia
2014-10-25 13:43 - 2014-10-25 13:43 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-25 13:43 - 2014-10-25 13:43 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-25 13:43 - 2014-10-25 13:43 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-25 13:43 - 2014-10-25 13:43 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-25 13:43 - 2014-10-25 13:43 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-10-25 13:43 - 2014-10-25 13:43 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-10-25 13:43 - 2014-10-25 13:43 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-10-25 13:43 - 2014-10-25 13:43 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-10-25 13:43 - 2014-10-25 13:43 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-10-25 13:43 - 2014-10-25 13:43 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-10-25 13:43 - 2014-10-25 13:43 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-10-25 13:43 - 2014-10-25 13:43 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-10-25 13:43 - 2014-10-25 13:43 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-10-25 13:40 - 2014-10-25 13:40 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-10-25 13:39 - 2014-10-25 13:49 - 00015936 _____ () C:\Windows\IE11_main.log
2014-10-25 13:39 - 2014-10-25 13:40 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2014-10-25 13:39 - 2014-10-25 13:39 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2014-10-25 13:39 - 2014-10-25 13:39 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2014-10-25 13:24 - 2014-11-07 02:00 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Adobe
2014-10-25 13:24 - 2014-10-31 18:21 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-25 13:24 - 2014-10-31 18:21 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-25 13:24 - 2014-10-25 13:24 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2014-10-25 13:24 - 2014-10-25 13:24 - 00000000 ____D () C:\Windows\system32\Macromed
2014-10-25 13:02 - 2012-07-26 04:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-10-25 13:02 - 2012-07-26 04:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-10-25 13:02 - 2012-07-26 04:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-10-25 13:02 - 2012-07-26 04:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-10-25 13:02 - 2012-07-26 04:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-10-25 13:02 - 2012-07-26 03:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-10-25 13:02 - 2012-07-26 03:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-10-25 13:02 - 2012-06-02 15:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-10-25 12:56 - 2012-03-01 07:46 - 00023408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2014-10-25 12:56 - 2012-03-01 07:28 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2014-10-25 12:56 - 2012-03-01 06:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
2014-10-25 12:54 - 2012-03-12 20:56 - 00947472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjava.dll
2014-10-25 12:54 - 2009-10-19 16:39 - 00718632 _____ (Guillemot) C:\Windows\SysWOW64\WebCamPropertyWindow.dll
2014-10-25 12:54 - 2009-10-19 16:39 - 00037672 _____ () C:\Windows\SysWOW64\WebCamKSProxyPlugin.ax
2014-10-25 12:54 - 2009-10-19 16:39 - 00029480 _____ (Guillemot Corporation S.A.) C:\Windows\SysWOW64\libcmmn.dll
2014-10-25 12:54 - 2009-02-09 09:43 - 00111104 _____ (Guillemot Corporation) C:\Windows\system32\Drivers\hxctlflt.sys
2014-10-25 12:54 - 2007-09-10 08:50 - 00527360 _____ (PixArt Imaging Inc.) C:\Windows\system32\Drivers\PAC7302.SYS
2014-10-25 12:54 - 2007-05-17 15:50 - 00129024 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\SP7302.AX
2014-10-25 12:54 - 2007-03-20 16:44 - 00000566 _____ () C:\Windows\SysWOW64\SP7302.INI
2014-10-25 12:51 - 2014-06-30 23:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-10-25 12:51 - 2014-06-30 23:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-10-25 12:51 - 2014-06-06 07:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-10-25 12:51 - 2014-06-06 07:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-10-25 12:51 - 2014-03-09 22:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-10-25 12:51 - 2014-03-09 22:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-10-25 12:51 - 2014-03-09 22:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-10-25 12:51 - 2014-03-09 22:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-10-25 12:50 - 2014-03-04 10:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-10-25 12:50 - 2014-03-04 10:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-10-25 12:50 - 2014-03-04 10:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-10-25 12:50 - 2014-03-04 10:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-10-25 12:50 - 2014-03-04 10:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-10-25 12:50 - 2014-03-04 10:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-10-25 12:50 - 2014-03-04 10:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-10-25 12:50 - 2014-03-04 10:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-10-25 12:50 - 2014-03-04 10:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-10-25 12:50 - 2014-03-04 10:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-10-25 12:50 - 2014-03-04 10:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-10-25 12:50 - 2014-03-04 10:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-10-25 12:50 - 2014-03-04 10:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-10-25 12:50 - 2014-03-04 10:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-10-25 12:50 - 2014-03-04 10:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-10-25 12:50 - 2014-03-04 10:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-10-25 12:50 - 2014-03-04 10:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-10-25 12:50 - 2014-03-04 10:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-10-25 12:50 - 2014-03-04 10:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-10-25 12:50 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-10-25 12:50 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2014-10-25 12:50 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2014-10-25 12:50 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-10-25 12:49 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-25 12:49 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-25 12:49 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-25 12:49 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-25 12:49 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-25 12:49 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-25 12:49 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-25 12:49 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-25 12:49 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-25 12:49 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-25 12:49 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-25 12:49 - 2014-07-07 03:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-10-25 12:49 - 2014-07-07 03:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-10-25 12:49 - 2014-07-07 02:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-10-25 12:49 - 2014-07-07 02:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-10-25 12:49 - 2014-07-07 02:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-10-25 12:49 - 2014-05-30 09:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-10-25 12:49 - 2014-05-30 09:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-10-25 12:49 - 2014-05-30 09:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-10-25 12:49 - 2014-05-30 09:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-10-25 12:49 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-10-25 12:49 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-10-25 12:49 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-10-25 12:49 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-10-25 12:49 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-10-25 12:49 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-10-25 12:49 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-10-25 12:49 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-10-25 12:49 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-10-25 12:49 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-10-25 12:49 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-10-25 12:49 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-10-25 12:49 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-10-25 12:49 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-10-25 12:49 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-10-25 12:49 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-10-25 12:49 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-10-25 12:49 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-10-25 12:49 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-10-25 12:49 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-10-25 12:49 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-10-25 12:49 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-10-25 12:49 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-10-25 12:49 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-10-25 12:49 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-25 12:49 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2014-10-25 12:49 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2014-10-25 12:49 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-25 12:49 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2014-10-25 12:49 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2014-10-25 12:49 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-10-25 12:49 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2014-10-25 12:49 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-10-25 12:49 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-10-25 12:49 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-10-25 12:49 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2014-10-25 12:49 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2014-10-25 12:49 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2014-10-25 12:49 - 2012-12-07 14:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2014-10-25 12:49 - 2012-12-07 14:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2014-10-25 12:49 - 2012-12-07 13:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2014-10-25 12:49 - 2012-12-07 13:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2014-10-25 12:49 - 2012-12-07 12:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2014-10-25 12:49 - 2012-12-07 12:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2014-10-25 12:49 - 2012-12-07 12:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2014-10-25 12:49 - 2012-12-07 12:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2014-10-25 12:49 - 2012-12-07 12:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2014-10-25 12:49 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2014-10-25 12:49 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2014-10-25 12:49 - 2012-12-07 12:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2014-10-25 12:49 - 2012-12-07 12:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2014-10-25 12:49 - 2012-12-07 12:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2014-10-25 12:49 - 2012-12-07 12:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2014-10-25 12:49 - 2012-12-07 12:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2014-10-25 12:49 - 2012-12-07 12:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2014-10-25 12:49 - 2012-12-07 12:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2014-10-25 12:49 - 2012-12-07 11:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2014-10-25 12:49 - 2012-04-26 06:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2014-10-25 12:49 - 2012-04-26 06:34 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\rdrmemptylst.exe
2014-10-25 12:49 - 2012-01-04 11:44 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2014-10-25 12:49 - 2012-01-04 09:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2014-10-25 12:49 - 2011-06-15 11:02 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\odbctrac.dll
2014-10-25 12:49 - 2011-06-15 11:02 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2014-10-25 12:49 - 2011-06-15 11:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccu32.dll
2014-10-25 12:49 - 2011-06-15 11:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccr32.dll
2014-10-25 12:49 - 2011-06-15 09:55 - 00319488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcjt32.dll
2014-10-25 12:49 - 2011-06-15 09:55 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbctrac.dll
2014-10-25 12:49 - 2011-06-15 09:55 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccp32.dll
2014-10-25 12:49 - 2011-06-15 09:55 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccu32.dll
2014-10-25 12:49 - 2011-06-15 09:55 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccr32.dll
2014-10-25 12:49 - 2010-12-23 11:42 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\sbe.dll
2014-10-25 12:49 - 2010-12-23 11:42 - 00961024 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2014-10-25 12:49 - 2010-12-23 11:36 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\mpg2splt.ax
2014-10-25 12:49 - 2010-12-23 06:54 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sbe.dll
2014-10-25 12:49 - 2010-12-23 06:54 - 00642048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2014-10-25 12:49 - 2010-12-23 06:50 - 00199680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mpg2splt.ax
2014-10-25 12:48 - 2014-09-09 23:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-10-25 12:48 - 2014-09-09 22:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-10-25 12:48 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-25 12:48 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-25 12:48 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-25 12:48 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-25 12:48 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-25 12:48 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-25 12:48 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-10-25 12:48 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-10-25 12:48 - 2014-04-05 03:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-10-25 12:48 - 2014-03-26 15:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-10-25 12:48 - 2014-03-26 15:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-10-25 12:48 - 2014-03-26 15:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-10-25 12:48 - 2014-03-26 15:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-10-25 12:48 - 2014-03-26 15:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-10-25 12:48 - 2014-03-26 15:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-10-25 12:48 - 2014-03-26 15:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-10-25 12:48 - 2014-03-26 15:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-10-25 12:48 - 2014-03-04 10:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-10-25 12:48 - 2014-03-04 10:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-10-25 12:48 - 2014-03-04 10:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-10-25 12:48 - 2014-03-04 10:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-10-25 12:48 - 2014-03-04 10:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-10-25 12:48 - 2014-03-04 10:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-10-25 12:48 - 2014-03-04 10:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-10-25 12:48 - 2014-03-04 10:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-10-25 12:48 - 2014-03-04 10:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-10-25 12:48 - 2014-03-04 09:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
         

FRST

2014-10-25 12:48 - 2014-03-04 09:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-10-25 12:48 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-10-25 12:48 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-10-25 12:48 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-10-25 12:48 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-10-25 12:48 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-10-25 12:48 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-10-25 12:48 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-10-25 12:48 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-10-25 12:48 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-10-25 12:48 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-10-25 12:48 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-10-25 12:48 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-10-25 12:48 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-10-25 12:48 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-10-25 12:48 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-10-25 12:48 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2014-10-25 12:48 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2014-10-25 12:48 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-10-25 12:48 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2014-10-25 12:48 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2014-10-25 12:48 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2014-10-25 12:48 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2014-10-25 12:48 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-10-25 12:48 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-10-25 12:48 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-10-25 12:48 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-10-25 12:48 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-10-25 12:48 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2014-10-25 12:48 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2014-10-25 12:48 - 2013-04-26 00:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2014-10-25 12:48 - 2013-03-31 23:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2014-10-25 12:48 - 2013-03-19 06:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2014-10-25 12:48 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-10-25 12:48 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2014-10-25 12:48 - 2012-11-28 23:56 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2014-10-25 12:48 - 2012-10-09 19:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2014-10-25 12:48 - 2012-10-09 19:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2014-10-25 12:48 - 2012-10-09 18:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2014-10-25 12:48 - 2012-10-09 18:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2014-10-25 12:48 - 2011-10-26 06:25 - 01572864 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-10-25 12:48 - 2011-10-26 05:32 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2014-10-25 12:47 - 2014-08-01 12:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-10-25 12:47 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-10-25 12:47 - 2014-04-05 03:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-10-25 12:47 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-10-25 12:47 - 2011-03-11 07:34 - 01359872 _____ (Microsoft Corporation) C:\Windows\system32\mfc42u.dll
2014-10-25 12:46 - 2011-03-11 07:34 - 01395712 _____ (Microsoft Corporation) C:\Windows\system32\mfc42.dll
2014-10-25 12:46 - 2011-03-11 06:33 - 01164288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll
2014-10-25 12:46 - 2011-03-11 06:33 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll
2014-10-25 12:46 - 2011-02-05 18:10 - 00642944 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-10-25 12:46 - 2011-02-05 18:10 - 00020352 _____ (Microsoft Corporation) C:\Windows\system32\kdusb.dll
2014-10-25 12:46 - 2011-02-05 18:10 - 00019328 _____ (Microsoft Corporation) C:\Windows\system32\kd1394.dll
2014-10-25 12:46 - 2011-02-05 18:10 - 00017792 _____ (Microsoft Corporation) C:\Windows\system32\kdcom.dll
2014-10-25 12:46 - 2011-02-05 18:06 - 00605552 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-25 12:46 - 2011-02-05 18:06 - 00566208 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2014-10-25 12:46 - 2011-02-05 18:06 - 00518672 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-10-25 12:45 - 2012-08-21 22:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2014-10-25 12:44 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-25 12:44 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-25 12:44 - 2014-06-03 11:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-25 12:44 - 2014-06-03 11:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-10-25 12:44 - 2014-06-03 11:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-10-25 12:44 - 2014-06-03 10:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-25 12:44 - 2014-06-03 10:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-10-25 12:44 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-10-25 12:43 - 2014-02-04 03:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-10-25 12:43 - 2014-02-04 03:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-10-25 12:43 - 2014-02-04 03:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-10-25 12:43 - 2014-02-04 03:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-10-25 12:43 - 2014-02-04 03:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-10-25 12:43 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-10-25 12:43 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-10-25 12:43 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-10-25 12:43 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2014-10-25 12:43 - 2012-05-05 09:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2014-10-25 12:43 - 2012-05-05 08:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2014-10-25 12:43 - 2011-06-16 06:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2014-10-25 12:43 - 2011-06-16 05:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xmllite.dll
2014-10-25 12:43 - 2011-05-24 12:42 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2014-10-25 12:43 - 2011-05-24 11:40 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devobj.dll
2014-10-25 12:43 - 2011-05-24 11:40 - 00044544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devrtl.dll
2014-10-25 12:43 - 2011-05-24 11:39 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cfgmgr32.dll
2014-10-25 12:43 - 2011-05-24 11:37 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvinst.exe
2014-10-25 12:41 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-25 12:41 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-25 12:41 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-10-25 12:41 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-10-25 12:41 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-10-25 12:41 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-10-25 12:41 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-10-25 12:41 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2014-10-25 12:41 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-10-25 12:41 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2014-10-25 12:41 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2014-10-25 12:41 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2014-10-25 12:41 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2014-10-25 12:41 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-10-25 12:41 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2014-10-25 12:41 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2014-10-25 12:41 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2014-10-25 12:41 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-10-25 12:41 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2014-10-25 12:41 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2014-10-25 12:41 - 2013-05-10 06:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-10-25 12:41 - 2013-05-10 04:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2014-10-25 12:41 - 2013-01-24 07:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2014-10-25 12:41 - 2012-09-25 23:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2014-10-25 12:41 - 2012-09-25 23:46 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2014-10-25 12:41 - 2012-03-17 08:58 - 00075120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2014-10-25 12:41 - 2011-12-30 07:26 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2014-10-25 12:41 - 2011-12-30 06:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2014-10-25 12:41 - 2011-05-03 06:29 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2014-10-25 12:41 - 2011-05-03 05:30 - 00741376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2014-10-25 12:40 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2014-10-25 12:40 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2014-10-25 12:40 - 2011-11-17 07:35 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2014-10-25 12:40 - 2011-11-17 06:35 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2014-10-25 12:39 - 2012-10-03 18:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2014-10-25 12:39 - 2012-10-03 18:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2014-10-25 12:39 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2014-10-25 12:39 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2014-10-25 12:39 - 2012-10-03 18:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2014-10-25 12:39 - 2012-10-03 18:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-10-25 12:39 - 2012-10-03 17:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2014-10-25 12:39 - 2012-10-03 17:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2014-10-25 12:39 - 2012-10-03 17:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2014-10-25 12:39 - 2012-10-03 17:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-10-25 12:39 - 2012-01-13 08:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2014-10-25 12:39 - 2011-05-04 06:25 - 02315776 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2014-10-25 12:39 - 2011-05-04 06:22 - 02223616 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2014-10-25 12:39 - 2011-05-04 06:22 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2014-10-25 12:39 - 2011-05-04 06:22 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2014-10-25 12:39 - 2011-05-04 06:22 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2014-10-25 12:39 - 2011-05-04 06:22 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2014-10-25 12:39 - 2011-05-04 06:19 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2014-10-25 12:39 - 2011-05-04 06:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2014-10-25 12:39 - 2011-05-04 06:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2014-10-25 12:39 - 2011-05-04 05:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2014-10-25 12:39 - 2011-05-04 05:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2014-10-25 12:39 - 2011-05-04 05:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2014-10-25 12:39 - 2011-05-04 05:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2014-10-25 12:39 - 2011-05-04 05:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2014-10-25 12:39 - 2011-05-04 05:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2014-10-25 12:39 - 2011-05-04 05:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2014-10-25 12:39 - 2011-05-04 05:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2014-10-25 12:39 - 2011-05-04 05:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2014-10-25 12:37 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-25 12:37 - 2014-06-25 03:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-10-25 12:37 - 2014-06-25 02:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-10-25 12:37 - 2014-01-24 03:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-10-25 12:37 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-10-25 12:37 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-10-25 12:37 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2014-10-25 12:37 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-10-25 12:37 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-10-25 12:37 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-10-25 12:37 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2014-10-25 12:37 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2014-10-25 12:37 - 2012-02-17 07:38 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2014-10-25 12:37 - 2012-02-17 06:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2014-10-25 12:37 - 2012-02-17 05:57 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2014-10-25 12:37 - 2011-04-29 04:06 - 00467456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2014-10-25 12:37 - 2011-04-29 04:05 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-10-25 12:37 - 2011-04-29 04:05 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-10-25 12:36 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-10-25 12:36 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-10-25 12:36 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2014-10-25 12:36 - 2011-08-17 06:26 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2014-10-25 12:36 - 2011-08-17 06:25 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2014-10-25 12:36 - 2011-08-17 05:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisdecd.dll
2014-10-25 12:36 - 2011-08-17 05:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisrndr.ax
2014-10-25 12:36 - 2011-07-09 03:46 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2014-10-25 12:36 - 2011-04-27 03:40 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-10-25 12:36 - 2011-04-27 03:39 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-10-25 12:35 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-10-25 12:35 - 2014-04-25 03:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-10-25 12:35 - 2014-04-25 03:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-10-25 12:35 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-10-25 12:35 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-10-25 12:35 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-10-25 12:35 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-10-25 12:35 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-10-25 12:35 - 2013-02-12 05:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-10-25 12:35 - 2012-08-22 19:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-10-25 12:35 - 2012-07-04 21:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2014-10-25 12:35 - 2011-12-16 09:46 - 00634880 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2014-10-25 12:35 - 2011-12-16 08:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2014-10-25 12:35 - 2011-03-03 07:24 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2014-10-25 12:35 - 2011-03-03 07:24 - 00183296 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2014-10-25 12:35 - 2011-03-03 07:21 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\dnscacheugc.exe
2014-10-25 12:35 - 2011-03-03 06:38 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2014-10-25 12:35 - 2011-03-03 06:36 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscacheugc.exe
2014-10-25 12:35 - 2011-02-12 12:34 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOVER.exe
2014-10-25 12:34 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-25 12:34 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-10-25 12:34 - 2014-06-16 03:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-10-25 12:34 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-10-25 12:34 - 2012-11-02 06:59 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2014-10-25 12:34 - 2012-11-02 06:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2014-10-25 12:34 - 2012-07-04 23:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2014-10-25 12:34 - 2012-07-04 23:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll
2014-10-25 12:34 - 2012-07-04 23:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll
2014-10-25 12:34 - 2012-07-04 22:16 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2014-10-25 12:34 - 2012-07-04 22:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2014-10-25 12:34 - 2012-05-01 06:40 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-10-25 12:34 - 2011-02-18 11:51 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe
2014-10-25 12:34 - 2011-02-18 06:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
2014-10-25 12:34 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-10-25 12:31 - 2014-04-12 03:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-10-25 12:31 - 2014-04-12 03:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-10-25 12:31 - 2014-04-12 03:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-10-25 12:31 - 2014-04-12 03:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-10-25 12:31 - 2014-04-12 03:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-10-25 12:31 - 2014-04-12 03:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-10-25 12:31 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-10-25 12:29 - 2014-08-23 03:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-10-25 12:29 - 2014-08-23 02:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-10-25 12:29 - 2012-06-06 07:02 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2014-10-25 12:29 - 2012-06-06 06:03 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2014-10-25 12:29 - 2011-10-15 07:31 - 00723456 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2014-10-25 12:29 - 2011-10-15 06:38 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2014-10-25 12:28 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-25 12:28 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-25 12:28 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2014-10-25 12:28 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-10-25 12:28 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-10-25 12:28 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-10-25 12:28 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-10-25 12:28 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2014-10-25 12:28 - 2012-05-14 06:26 - 00956928 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-10-25 12:28 - 2011-08-27 06:37 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-10-25 12:28 - 2011-08-27 06:37 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2014-10-25 12:28 - 2011-08-27 05:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-10-25 12:28 - 2011-08-27 05:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll
2014-10-25 12:27 - 2011-02-23 05:55 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2014-10-25 12:26 - 2014-07-14 03:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-10-25 12:26 - 2014-07-14 02:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-10-25 12:18 - 2014-11-07 23:18 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Skype
2014-10-25 12:18 - 2014-10-25 12:18 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Skype
2014-10-25 12:17 - 2014-10-25 12:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-10-25 12:17 - 2014-10-25 12:17 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-25 12:17 - 2014-10-25 12:17 - 00000000 ____D () C:\ProgramData\Skype
2014-10-25 12:17 - 2014-10-25 12:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-10-25 12:16 - 2014-10-25 12:16 - 01677920 _____ (Skype Technologies S.A.) C:\Users\SiXidE\Downloads\SkypeSetup.exe
2014-10-25 12:16 - 2014-05-14 17:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-10-25 12:16 - 2014-05-14 17:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-10-25 12:16 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-10-25 12:16 - 2014-05-14 17:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-10-25 12:16 - 2014-05-14 17:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-10-25 12:16 - 2014-05-14 17:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-10-25 12:16 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-10-25 12:16 - 2014-05-14 17:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-10-25 12:16 - 2014-05-14 17:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-10-25 12:16 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-10-25 12:16 - 2014-05-14 08:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-10-25 12:16 - 2014-05-14 08:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-10-25 12:16 - 2014-05-14 08:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-10-25 12:16 - 2014-05-14 08:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-10-25 12:11 - 2014-11-07 10:06 - 00008502 _____ () C:\Windows\PFRO.log
2014-10-25 12:06 - 2014-10-25 11:15 - 00000000 ____D () C:\Windows\Panther
2014-10-25 12:02 - 2014-10-25 12:02 - 00000000 ____D () C:\Windows\system32\SPReview
2014-10-25 12:02 - 2014-10-25 12:02 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-10-25 12:02 - 2010-11-05 02:57 - 00048976 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll
2014-10-25 12:01 - 2010-11-20 14:44 - 01077248 _____ (Microsoft Corporation) C:\Windows\system32\Narrator.exe
2014-10-25 12:01 - 2010-11-20 14:44 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\NAPHLPR.DLL
2014-10-25 12:01 - 2010-11-20 14:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\NAPCRYPT.DLL
2014-10-25 12:01 - 2010-11-20 14:39 - 05066752 _____ (Microsoft Corporation) C:\Windows\system32\AuthFWSnapin.dll
2014-10-25 12:01 - 2010-11-20 14:34 - 00363392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys
2014-10-25 12:01 - 2010-11-20 14:34 - 00295808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-10-25 12:01 - 2010-11-20 14:34 - 00215936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2014-10-25 12:01 - 2010-11-20 14:34 - 00199552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmbus.sys
2014-10-25 12:01 - 2010-11-20 14:34 - 00071552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2014-10-25 12:01 - 2010-11-20 14:34 - 00046464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmstorfl.sys
2014-10-25 12:01 - 2010-11-20 14:34 - 00034688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storvsc.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00366976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00299392 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2014-10-25 12:01 - 2010-11-20 14:33 - 00289664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00263040 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2014-10-25 12:01 - 2010-11-20 14:33 - 00213888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00184704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00171392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scsiport.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00155008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpio.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00140672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msdsm.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00103808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sbp2port.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00094592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00078720 _____ (Hewlett-Packard Company) C:\Windows\system32\Drivers\HpSAMD.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00063360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00052096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winhv.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00031104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msahci.sys
2014-10-25 12:01 - 2010-11-20 14:33 - 00014720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hwpolicy.sys
2014-10-25 12:01 - 2010-11-20 14:32 - 02217856 _____ (Microsoft Corporation) C:\Windows\system32\bootres.dll
2014-10-25 12:01 - 2010-11-20 14:32 - 00334208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2014-10-25 12:01 - 2010-11-20 14:32 - 00179072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-10-25 12:01 - 2010-11-20 14:29 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2014-10-25 12:01 - 2010-11-20 14:28 - 00780008 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-10-25 12:01 - 2010-11-20 14:28 - 00298104 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2014-10-25 12:01 - 2010-11-20 14:28 - 00166784 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 03860992 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbon.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 03650560 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 03027968 _____ (Microsoft Corporation) C:\Windows\system32\WMVCORE.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 03008000 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02652160 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02543616 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02262528 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02250752 _____ (Microsoft Corporation) C:\Windows\system32\SensorsCpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02193920 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02146816 _____ (Microsoft Corporation) C:\Windows\system32\networkmap.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02086912 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02072576 _____ (Microsoft Corporation) C:\Windows\system32\WMPEncEn.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02055680 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 02018304 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01911808 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01900544 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01808384 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01753088 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\netcenter.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01672704 _____ (Microsoft Corporation) C:\Windows\system32\networkexplorer.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01646080 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01556992 _____ (Microsoft Corporation) C:\Windows\system32\RacEngn.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01509888 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01441280 _____ (Microsoft Corporation) C:\Windows\system32\wlanpref.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01363968 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01326080 _____ (Microsoft Corporation) C:\Windows\system32\NaturalLanguage6.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01281024 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01243136 _____ (Microsoft Corporation) C:\Windows\system32\WMNetMgr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01232896 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 01212416 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01197056 _____ (Microsoft Corporation) C:\Windows\system32\taskschd.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 01158656 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01098240 _____ (Microsoft Corporation) C:\Windows\system32\Vault.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01082880 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01080320 _____ (Microsoft Corporation) C:\Windows\system32\onexui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01050624 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01024512 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 01008128 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00933888 _____ (Microsoft Corporation) C:\Windows\system32\sqlsrv32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00933376 _____ (Microsoft Corporation) C:\Windows\system32\SmiEngine.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00898560 _____ (Microsoft Corporation) C:\Windows\system32\OobeFldr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00867840 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00849920 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00812032 _____ (Microsoft Corporation) C:\Windows\system32\wpccpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00799744 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00781312 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\sud.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\sdcpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\odbc32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00691200 _____ (Microsoft Corporation) C:\Windows\system32\VAN.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00666112 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\PerfCenterCPL.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00636416 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmdev.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00633344 _____ (Microsoft Corporation) C:\Windows\system32\riched20.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00605696 _____ (Microsoft Corporation) C:\Windows\system32\wmpeffects.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00582656 _____ (Microsoft Corporation) C:\Windows\system32\sxs.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\wiaservc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00577536 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\mspbda.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00568832 _____ (Microsoft Corporation) C:\Windows\system32\scrptadm.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\msdri.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00527872 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmnet.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\wmicmiplugin.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\WinSATAPI.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\powercpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00481280 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\QAGENTRT.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\wiadefui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\nshipsec.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00451072 _____ (Microsoft Corporation) C:\Windows\system32\shwebsvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\sqlcese30.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\spwizeng.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00435712 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceStatus.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00431104 _____ (Microsoft Corporation) C:\Windows\system32\WPDSp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\termmgr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00418816 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\prnfldr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wlanui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00403968 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\mtxclu.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\shsvcs.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00366080 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00358400 _____ (Microsoft Corporation) C:\Windows\system32\wmpdxm.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\sharemediacpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\srchadmin.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\raschap.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\netdiagfx.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\scansetting.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00299520 _____ (Microsoft Corporation) C:\Windows\system32\tsmf.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\srrstr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00268288 _____ (Microsoft Corporation) C:\Windows\system32\MSAC3ENC.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\QAGENT.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00264192 _____ (Microsoft Corporation) C:\Windows\system32\upnp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\spwizui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\wavemsp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\tcpipcfg.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\qdv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\sqmapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\taskbarcpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\mstask.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\onex.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\scecli.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\sppcomapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceSyncProvider.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\wmpsrcwp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\QSHVHOST.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\OnLineIDCpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\netiohlp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\wpdwcn.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00214528 _____ (Microsoft Corporation) C:\Windows\system32\umrdp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\rasppp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\sysclass.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\tscfgwmi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\syncui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsbas.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\netjoin.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\provsvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\prncache.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\qcap.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\twext.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\sdrsvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\netid.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\ocsetapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\prntvpt.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00154624 _____ (Microsoft Corporation) C:\Windows\system32\uxlib.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\remotepg.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\recovery.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\mydocs.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\shacct.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\wmpshell.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\ntlanman.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\srvcli.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\wiavideo.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\QSVRMGMT.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\wkssvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\WPDShServiceObj.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\thumbcache.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\QUTIL.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\sppnp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\regapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\nci.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\UserAccountControlSettings.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\QCLIPROV.DLL
2014-10-25 12:01 - 2010-11-20 14:27 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\spbcd.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\tlscsp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\unimdmat.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\napdsnap.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\wkscli.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\vfwwdm32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\rdpd3d.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\samcli.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ncryptui.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\RpcRtRemote.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\WavDest.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\vss_ps.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\umb.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\rtutils.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\PrintIsolationProxy.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\msasn1.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\vpnikeapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\msvidc32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\shimgvw.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\wdiasqmmodule.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\msdmo.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\profprov.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\netutils.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\shgina.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\msyuv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\sisbkup.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\schedcli.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\rdprefdrvapi.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\TRAPI.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\spopk.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\syssetup.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\muifontsetup.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\msrle32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\nrpsrv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\tsbyuv.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\wshirda.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\shunimpl.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\riched32.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\rdpcfgex.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-10-25 12:01 - 2010-11-20 14:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-10-25 12:01 - 2010-11-20 14:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 04120064 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 03391488 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 03205120 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 02067456 _____ (Microsoft Corporation) C:\Windows\system32\d3d9.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01866240 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01457664 _____ (Microsoft Corporation) C:\Windows\system32\DxpTaskSync.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01340416 _____ (Microsoft Corporation) C:\Windows\system32\diagperf.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01244160 _____ (Microsoft Corporation) C:\Windows\system32\imapi2fs.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\DiagCpl.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01066496 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00934912 _____ (Microsoft Corporation) C:\Windows\system32\FirewallControlPanel.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00861184 _____ (Microsoft Corporation) C:\Windows\system32\fontext.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00828416 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00784896 _____ (Microsoft Corporation) C:\Windows\system32\gpprefcl.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\dsuiext.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00675328 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\ipsmsnap.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00551936 _____ (Microsoft Corporation) C:\Windows\system32\localsec.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCenter.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\imapi2.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2014-10-25 12:01 - 2010-11-20 14:26 - 00495104 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\DXP.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\FXSTIFF.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00422912 _____ (Microsoft Corporation) C:\Windows\system32\drvstore.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00355328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\MediaMetadataHandler.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\hgcpl.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00317952 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\dot3ui.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\efscore.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\framedynos.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\iTVData.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00281600 _____ (Microsoft) C:\Windows\system32\DShowRdpFilter.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00279552 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\framedyn.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dot3svc.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00240640 _____ (Microsoft Corporation) C:\Windows\system32\MFPlay.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dskquoui.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\hgprint.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00233984 _____ (Microsoft Corporation) C:\Windows\system32\defaultlocationcpl.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\ListSvc.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingFolder.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\mprapi.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\iasrad.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\mprddm.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\iasrecst.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\logoncli.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ifsutil.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\fde.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\dps.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL
2014-10-25 12:01 - 2010-11-20 14:26 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\EhStorAPI.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\dwmredir.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\fphc.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\dnscmmc.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00116224 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\fms.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\dot3msm.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\iasacct.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\KMSVC.DLL
2014-10-25 12:01 - 2010-11-20 14:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\Mcx2Svc.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\dot3api.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\hbaapi.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fdProxy.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\dot3cfg.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\inetmib1.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\iyuv_32.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\lsmproxy.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\luainstall.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\httpapi.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\FXSMON.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mimefilt.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mciqtz32.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\iscsium.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dsauth.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\HotStartUserAgent.dll
2014-10-25 12:01 - 2010-11-20 14:26 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\elsTrans.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 03957760 _____ (Microsoft Corporation) C:\Windows\system32\WinSAT.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 03745792 _____ (Microsoft Corporation) C:\Windows\system32\accessibilitycpl.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 03524608 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 01975296 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 01504256 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 01264640 _____ (Microsoft Corporation) C:\Windows\system32\sdclt.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 01065984 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00974336 _____ (Microsoft Corporation) C:\Windows\system32\WFS.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00897536 _____ (Microsoft Corporation) C:\Windows\system32\azroles.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00749568 _____ (Microsoft Corporation) C:\Windows\system32\batmeter.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayCpl.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-10-25 12:01 - 2010-11-20 14:25 - 00692224 _____ (Microsoft Corporation) C:\Windows\system32\cscsvc.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\spinstall.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00577024 _____ (Microsoft Corporation) C:\Windows\system32\AdmTmpl.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00549888 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenterCPL.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00533504 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\biocpl.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\cscui.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\appmgr.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00472064 _____ (Microsoft Corporation) C:\Windows\system32\azroleui.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00464384 _____ (Microsoft Corporation) C:\Windows\system32\taskeng.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\nltest.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00349696 _____ (Microsoft Corporation) C:\Windows\system32\slui.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00314368 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\spreview.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00293888 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\schtasks.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\sethc.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00273920 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\taskmgr.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00240640 _____ (Microsoft Corporation) C:\Windows\system32\cscobj.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\recdisc.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00213504 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\rdpclip.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\cfgmgr32.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\PkgMgr.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\ocsetup.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\PresentationSettings.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\perfmon.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\bcdsrv.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\autoplay.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\net1.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00137216 _____ (Microsoft Corporation) C:\Windows\system32\CscMig.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayServices.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00128000 _____ (Microsoft) C:\Windows\system32\Robocopy.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\AxInstSv.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\nslookup.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\cca.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\cabinet.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\amstream.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\setupcl.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\tabcal.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\CertPolEng.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\takeown.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\PnPUnattend.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\tzutil.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\runonce.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\PushPrinterConnections.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\acppage.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\repair-bde.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\MultiDigiMon.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\cscapi.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\proquota.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\AzSqlExt.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\userinit.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\cscdll.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\qprocess.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\bitsperf.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\tskill.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\qappsrv.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\tscon.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\tsdiscon.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\shadow.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\rwinsta.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\reset.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\query.exe
2014-10-25 12:01 - 2010-11-20 14:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\BWUnpairElevated.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2014-10-25 12:01 - 2010-11-20 14:25 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\C_ISCII.DLL
2014-10-25 12:01 - 2010-11-20 14:24 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00899584 _____ (Microsoft Corporation) C:\Windows\system32\Bubbles.scr
2014-10-25 12:01 - 2010-11-20 14:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\system32\mmsys.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00793088 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00763904 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\appwiz.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\bthprops.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\FXSSVC.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\TabletPC.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00653312 _____ (Microsoft Corporation) C:\Windows\system32\lpksetup.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00606208 _____ (Microsoft Corporation) C:\Windows\system32\dfrgui.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\main.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00477696 _____ (Microsoft Corporation) C:\Windows\system32\PhotoScreensaver.scr
2014-10-25 12:01 - 2010-11-20 14:24 - 00474112 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-10-25 12:01 - 2010-11-20 14:24 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2014-10-25 12:01 - 2010-11-20 14:24 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00373248 _____ (Microsoft Corporation) C:\Windows\system32\intl.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\diskraid.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\eudcedit.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00352768 _____ (Microsoft Corporation) C:\Windows\system32\sysdm.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00345088 _____ (Microsoft Corporation) C:\Windows\system32\cmd.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\lsm.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00333824 _____ (Microsoft Corporation) C:\Windows\system32\ssText3d.scr
2014-10-25 12:01 - 2010-11-20 14:24 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\unimdm.tsp
2014-10-25 12:01 - 2010-11-20 14:24 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\msconfig.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\MSNP.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00272896 _____ (Microsoft Corporation) C:\Windows\system32\mcbuilder.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\Mystify.scr
2014-10-25 12:01 - 2010-11-20 14:24 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\Ribbons.scr
2014-10-25 12:01 - 2010-11-20 14:24 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\bitsadmin.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\fsquirt.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\wdmaud.drv
2014-10-25 12:01 - 2010-11-20 14:24 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\VBICodec.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\bcdboot.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\powercfg.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\diskpart.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\iscsicli.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\MdSched.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\Kswdmcap.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\desk.cpl
2014-10-25 12:01 - 2010-11-20 14:24 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\aitagent.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\Mpeg2Data.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\kstvtune.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\mobsync.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\WSTPager.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\cmstp.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\isoburn.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\manage-bde.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\MSDvbNP.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\findstr.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\bfsvc.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ksxbar.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\djoin.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\g711codc.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\ftp.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\vbisurf.ax
2014-10-25 12:01 - 2010-11-20 14:24 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\choice.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\LogonUI.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\chgport.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\chglogon.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\logoff.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\chgusr.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\FXSUNATD.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2014-10-25 12:01 - 2010-11-20 14:24 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\change.exe
2014-10-25 12:01 - 2010-11-20 14:15 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll
2014-10-25 12:01 - 2010-11-20 14:13 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\RDPENCDD.dll
2014-10-25 12:01 - 2010-11-20 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll
2014-10-25 12:01 - 2010-11-20 14:09 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\vmbusres.dll
2014-10-25 12:01 - 2010-11-20 14:09 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\vmstorfltres.dll
2014-10-25 12:01 - 2010-11-20 14:02 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2014-10-25 12:01 - 2010-11-20 14:02 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2014-10-25 12:01 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUF.DLL
2014-10-25 12:01 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDSF.DLL
2014-10-25 12:01 - 2010-11-20 13:51 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-25 12:01 - 2010-11-20 13:51 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-ums-l1-1-0.dll
2014-10-25 12:01 - 2010-11-20 13:36 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPHLPR.DLL
2014-10-25 12:01 - 2010-11-20 13:36 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPCRYPT.DLL
2014-10-25 12:01 - 2010-11-20 13:32 - 05066752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuthFWSnapin.dll
2014-10-25 12:01 - 2010-11-20 13:23 - 00144768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 02983424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbon.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 02755072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themeui.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 02202624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsCpl.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 02157568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themecpl.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 02146304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncCenter.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01712640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01667584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01624064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPEncEn.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01363456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01326592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanpref.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01227776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01175040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01128448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01115136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RacEngn.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 01003008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMNetMgr.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00933376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Vault.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00902656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2014-10-25 12:01 - 2010-11-20 13:21 - 00782336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00778240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlsrv32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00755200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sud.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00739328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2014-10-25 12:01 - 2010-11-20 13:21 - 00738816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpmde.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00638976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VAN.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00616960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00600064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSDECD.DLL
2014-10-25 12:01 - 2010-11-20 13:21 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmdev.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00505856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskschd.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00473600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched20.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00464896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrptadm.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00458752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00436736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmnet.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00428544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shwebsvc.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00416768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiadefui.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00411648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlangpui.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00410624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\systemcpl.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00410112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanui.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00380416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sxs.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\termmgr.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizeng.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00352256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpeffects.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00351232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00350720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDSp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00350208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shlwapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00346624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00335872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSATAPI.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00328192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsvcs.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\raschap.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlcese30.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00307712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srchadmin.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00299520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpdxm.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00270848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsmf.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00269824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00246272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scansetting.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tapisrv.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00228352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wavemsp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVolSSO.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\upnp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00198144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdwcn.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppcomapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqmapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpsrcwp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00181760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpipcfg.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasppp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scecli.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vdsbas.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syncui.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remotepg.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twext.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpps.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00140800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00135168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsRasterService.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxlib.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00113664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00109568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiavideo.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shacct.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDShServiceObj.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00105472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpshell.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppinst.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srvcli.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\thumbcache.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QUTIL.DLL
2014-10-25 12:01 - 2010-11-20 13:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserAccountControlSettings.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\regapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tlscsp.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spbcd.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdmat.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vfwwdm32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpd3d.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00051200 _____ (Twain Working Group) C:\Windows\twain_32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samcli.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wkscli.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RpcRtRemote.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wtsapi32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtutils.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimgvw.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\utildll.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vpnikeapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsdchngr.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TRAPI.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdprefdrvapi.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shgina.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spopk.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sisbkup.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schedcli.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syssetup.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00012288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsbyuv.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshirda.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shunimpl.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched32.dll
2014-10-25 12:01 - 2010-11-20 13:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2014-10-25 12:01 - 2010-11-20 13:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 02504192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVCORE.DLL
2014-10-25 12:01 - 2010-11-20 13:20 - 02494464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netshell.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 02130944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkmap.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 01750528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pnidui.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 01661440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkexplorer.dll
         

FRST

2014-10-25 12:01 - 2010-11-20 13:20 - 01644032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcenter.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 01508864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pla.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 01414144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpcServices.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 01111552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onexui.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00932352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printui.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00859648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OobeFldr.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00801280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NaturalLanguage6.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00600576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PerfCenterCPL.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbc32.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00563712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00547840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceApi.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercpl.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceStatus.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00395264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prnfldr.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00346112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshipsec.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00324608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\photowiz.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00283136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdv.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00236544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00225792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netdiagfx.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00218112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OnLineIDCpl.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qasf.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onex.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00190976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qcap.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00183296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceSyncProvider.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netplwiz.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetapi.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QAGENT.DLL
2014-10-25 12:01 - 2010-11-20 13:20 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSHVHOST.DLL
2014-10-25 12:01 - 2010-11-20 13:20 - 00166400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiohlp.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\provsvc.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netjoin.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00136192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mydocs.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00121344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prntvpt.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netid.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prncache.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSVRMGMT.DLL
2014-10-25 12:01 - 2010-11-20 13:20 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nci.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olethk32.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QCLIPROV.DLL
2014-10-25 12:01 - 2010-11-20 13:20 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntlanman.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\napdsnap.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptui.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netutils.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfts.dll
2014-10-25 12:01 - 2010-11-20 13:20 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 03207680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 02151936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 01493504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00954752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00954288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40u.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00856576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallControlPanel.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00830464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2014-10-25 12:01 - 2010-11-20 13:19 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontext.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00732160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2fs.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00592384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00584192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpprefcl.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00429056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\localsec.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ipsmsnap.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00392192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxclu.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hgcpl.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00296448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprddm.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MediaMetadataHandler.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00226304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSAC3ENC.DLL
2014-10-25 12:01 - 2010-11-20 13:19 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iTVData.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00213504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MMDevAPI.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstask.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedynos.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedyn.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFPlay.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrad.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msutb.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprapi.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00148992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ifsutil.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logoncli.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fde.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrecst.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvfw32.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IPHLPAPI.DLL
2014-10-25 12:01 - 2010-11-20 13:19 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\migisol.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fphc.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00093696 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\SysWOW64\fms.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciavi32.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00082944 _____ (Radius Inc.) C:\Windows\SysWOW64\iccvid.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasacct.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapistub.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapi32.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hbaapi.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdeploy.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetmib1.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iyuv_32.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mimefilt.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\luainstall.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciqtz32.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\httpapi.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msasn1.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvidc32.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdmo.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsium.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msyuv.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lsmproxy.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\muifontsetup.dll
2014-10-25 12:01 - 2010-11-20 13:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrle32.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 03727872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\accessibilitycpl.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 02522624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 01828352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d9.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 01555456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certmgr.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 01400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DxpTaskSync.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 01371136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 01334272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertEnroll.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 01040384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 01003520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00854016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00762880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroles.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00744448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenter.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00743424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00740864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\batmeter.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00685056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsuiext.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuxiliaryDisplayCpl.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00630784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00537600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenterCPL.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00485888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00484864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceCenter.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00438272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AdmTmpl.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00402944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appmgr.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00333824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3ui.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvstore.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroleui.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00257024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpx.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00252928 _____ (Microsoft) C:\Windows\SysWOW64\DShowRdpFilter.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00243712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\audiodev.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapp3hst.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00230912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapphost.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\defaultlocationcpl.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00211456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairingFolder.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiagn.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00205312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\efscore.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\activeds.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dskquoui.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adsldp.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoplay.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscobj.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00132608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabview.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EhStorAPI.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3msm.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscmmc.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappgnui.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\avifil32.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3api.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3cfg.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabinet.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\amstream.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cca.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertPolEng.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\acppage.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscapi.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsauth.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00028160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzSqlExt.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscdll.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elsTrans.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsperf.dll
2014-10-25 12:01 - 2010-11-20 13:18 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\C_ISCII.DLL
2014-10-25 12:01 - 2010-11-20 13:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browseui.dll
2014-10-25 12:01 - 2010-11-20 13:17 - 00586752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfrgui.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimserv.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVol.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00302592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00288256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eudcedit.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00276480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskraid.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sethc.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskmgr.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mcbuilder.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PkgMgr.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00197632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetup.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskeng.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00144896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsicli.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\net1.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskpart.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00113152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupugc.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00101376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mobsync.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00098816 _____ (Microsoft) C:\Windows\SysWOW64\Robocopy.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nslookup.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logagent.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\isoburn.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmstp.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MuiUnattend.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\w32tm.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00062976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\findstr.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\takeown.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PushPrinterConnections.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\runonce.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzutil.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ftp.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unlodctr.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\proquota.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userinit.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiougc.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2014-10-25 12:01 - 2010-11-20 13:17 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgentc.exe
2014-10-25 12:01 - 2010-11-20 13:16 - 00905216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmsys.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00878592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Bubbles.scr
2014-10-25 12:01 - 2010-11-20 13:16 - 00776192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe
2014-10-25 12:01 - 2010-11-20 13:16 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bthprops.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00679424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoconv.exe
2014-10-25 12:01 - 2010-11-20 13:16 - 00668160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2014-10-25 12:01 - 2010-11-20 13:16 - 00658944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autofmt.exe
2014-10-25 12:01 - 2010-11-20 13:16 - 00649216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appwiz.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00516096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\main.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00413696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoScreensaver.scr
2014-10-25 12:01 - 2010-11-20 13:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2014-10-25 12:01 - 2010-11-20 13:16 - 00345088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\intl.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysdm.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00320000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2014-10-25 12:01 - 2010-11-20 13:16 - 00293888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ssText3d.scr
2014-10-25 12:01 - 2010-11-20 13:16 - 00281088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdm.tsp
2014-10-25 12:01 - 2010-11-20 13:16 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Mystify.scr
2014-10-25 12:01 - 2010-11-20 13:16 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Ribbons.scr
2014-10-25 12:01 - 2010-11-20 13:16 - 00204288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSNP.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsadmin.exe
2014-10-25 12:01 - 2010-11-20 13:16 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdmaud.drv
2014-10-25 12:01 - 2010-11-20 13:16 - 00153600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VBICodec.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercfg.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\desk.cpl
2014-10-25 12:01 - 2010-11-20 13:16 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Kswdmcap.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kstvtune.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00072704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Mpeg2Data.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSTPager.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSDvbNP.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksxbar.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\g711codc.ax
2014-10-25 12:01 - 2010-11-20 13:16 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbisurf.ax
2014-10-25 12:01 - 2010-11-20 13:08 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-10-25 12:01 - 2010-11-20 13:08 - 00119808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imm32.dll
2014-10-25 12:01 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUF.DLL
2014-10-25 12:01 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSG.DLL
2014-10-25 12:01 - 2010-11-20 13:07 - 01164800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll
2014-10-25 12:01 - 2010-11-20 13:00 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2014-10-25 12:01 - 2010-11-20 13:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2014-10-25 12:01 - 2010-11-20 12:37 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbrpm.sys
2014-10-25 12:01 - 2010-11-20 12:06 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpdr.sys
2014-10-25 12:01 - 2010-11-20 12:05 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\rdpdd.dll
2014-10-25 12:01 - 2010-11-20 11:52 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndiswan.sys
2014-10-25 12:01 - 2010-11-20 11:52 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2014-10-25 12:01 - 2010-11-20 11:52 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2014-10-25 12:01 - 2010-11-20 11:52 - 00111104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\raspptp.sys
2014-10-25 12:01 - 2010-11-20 11:52 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2014-10-25 12:01 - 2010-11-20 11:52 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ipfltdrv.sys
2014-10-25 12:01 - 2010-11-20 11:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2014-10-25 12:01 - 2010-11-20 11:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tunnel.sys
2014-10-25 12:01 - 2010-11-20 11:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndisuio.sys
2014-10-25 12:01 - 2010-11-20 11:49 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2014-10-25 12:01 - 2010-11-20 11:44 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys
2014-10-25 12:01 - 2010-11-20 11:44 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\1394ohci.sys
2014-10-25 12:01 - 2010-11-20 11:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\umbus.sys
2014-10-25 12:01 - 2010-11-20 11:44 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD2.sys
2014-10-25 12:01 - 2010-11-20 11:43 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-10-25 12:01 - 2010-11-20 11:43 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winusb.sys
2014-10-25 12:01 - 2010-11-20 11:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-10-25 12:01 - 2010-11-20 11:34 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_sd.sys
2014-10-25 12:01 - 2010-11-20 11:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2014-10-25 12:01 - 2010-11-20 11:33 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\CompositeBus.sys
2014-10-25 12:01 - 2010-11-20 11:33 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2014-10-25 12:01 - 2010-11-20 11:14 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-10-25 12:01 - 2010-11-20 11:09 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scfilter.sys
2014-10-25 12:01 - 2010-11-20 11:04 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-10-25 12:01 - 2010-11-20 10:58 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe
2014-10-25 12:01 - 2010-11-20 10:57 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\VmbusCoinstaller.dll
2014-10-25 12:01 - 2010-11-20 10:57 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\VmdCoinstall.dll
2014-10-25 12:01 - 2010-11-20 10:57 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll
2014-10-25 12:01 - 2010-11-20 10:57 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\vmictimeprovider.dll
2014-10-25 12:01 - 2010-11-20 10:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\vmbuspipe.dll
2014-10-25 12:01 - 2010-11-20 10:30 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpipmi.sys
2014-10-25 12:01 - 2010-11-20 10:27 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\csc.sys
2014-10-25 12:01 - 2010-11-20 10:27 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2014-10-25 12:01 - 2010-11-20 10:26 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2014-10-25 12:01 - 2010-11-20 10:26 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2014-10-25 12:01 - 2010-11-20 10:25 - 00753664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2014-10-25 12:01 - 2010-11-20 10:23 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2014-10-25 12:01 - 2010-11-20 10:22 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdi.sys
2014-10-25 12:01 - 2010-11-20 10:21 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-10-25 12:01 - 2010-11-20 10:19 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdrom.sys
2014-10-25 12:01 - 2010-11-10 02:48 - 00010429 _____ () C:\Windows\system32\ScavengeSpace.xml
2014-10-25 12:01 - 2010-11-05 03:20 - 00347904 _____ () C:\Windows\system32\systemsf.ebd
2014-10-25 12:01 - 2010-11-05 03:11 - 00433512 _____ (Microsoft Corporation) C:\Windows\system32\MCEWMDRMNDBootstrap.dll
2014-10-25 12:01 - 2010-11-05 03:11 - 00312168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCEWMDRMNDBootstrap.dll
2014-10-25 12:01 - 2010-11-05 02:58 - 00297808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscoree.dll
2014-10-25 12:01 - 2010-11-05 02:58 - 00049488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netfxperf.dll
2014-10-25 12:01 - 2010-11-05 02:57 - 00444752 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll
2014-10-25 12:01 - 2010-11-05 02:53 - 00320352 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe
2014-10-25 12:01 - 2010-11-05 02:53 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHost.exe
2014-10-25 12:01 - 2010-11-05 02:53 - 00109928 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll
2014-10-25 12:01 - 2010-11-05 02:53 - 00099176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHostProxy.dll
2014-10-25 12:01 - 2009-07-14 02:16 - 00629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pmcsnap.dll
2014-10-25 12:01 - 2009-07-14 02:16 - 00238080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ppcsnap.dll
2014-10-25 12:01 - 2009-07-14 02:16 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpmonui.dll
2014-10-25 12:00 - 2014-10-25 12:00 - 13087456 _____ (Microsoft Corporation) C:\Users\SiXidE\Downloads\Silverlight_x64.exe
2014-10-25 12:00 - 2010-11-20 14:27 - 00529408 _____ (Microsoft Corporation) C:\Windows\system32\wbemcomn.dll
2014-10-25 12:00 - 2010-11-20 14:26 - 00399872 _____ (Microsoft Corporation) C:\Windows\system32\dpx.dll
2014-10-25 12:00 - 2010-11-20 14:14 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwizres.dll
2014-10-25 12:00 - 2010-11-20 14:13 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2014-10-25 12:00 - 2010-11-20 14:12 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\pifmgr.dll
2014-10-25 12:00 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUQ.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDSG.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\kbdlk41a.dll
2014-10-25 12:00 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDGKL.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDCZ1.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDPO.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDNEPR.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTAM.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINBEN.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDGR1.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUS.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUGHR1.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTURME.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAJIK.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMON.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMAORI.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDLT1.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTEL.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINORI.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINMAR.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINKAN.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINHIN.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBULG.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBLR.DLL
2014-10-25 12:00 - 2010-11-20 14:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDGEO.DLL
2014-10-25 12:00 - 2010-11-20 13:58 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\dpnaddr.dll
2014-10-25 12:00 - 2010-11-20 13:54 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\BlbEvents.dll
2014-10-25 12:00 - 2010-11-20 13:21 - 00363008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wbemcomn.dll
2014-10-25 12:00 - 2010-11-20 13:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdscore.dll
2014-10-25 12:00 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUQ.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdlk41a.dll
2014-10-25 12:00 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGR1.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGKL.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDCZ1.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSF.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDPO.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDNEPR.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTAM.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINORI.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINMAR.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINKAN.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINHIN.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINBEN.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUS.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUGHR1.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTURME.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAJIK.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMON.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMAORI.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDLT1.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTEL.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGEO.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBULG.DLL
2014-10-25 12:00 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBLR.DLL
2014-10-25 12:00 - 2010-11-20 13:07 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizres.dll
2014-10-25 12:00 - 2010-11-20 13:06 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2014-10-25 12:00 - 2010-11-20 13:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pifmgr.dll
2014-10-25 12:00 - 2010-11-20 12:57 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnaddr.dll
2014-10-25 12:00 - 2010-11-20 10:57 - 00021760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\VMBusHID.sys
2014-10-25 12:00 - 2010-11-20 10:57 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vms3cap.sys
2014-10-25 12:00 - 2010-11-05 03:20 - 00105559 _____ () C:\Windows\SysWOW64\RacRules.xml
2014-10-25 12:00 - 2010-11-05 03:20 - 00105559 _____ () C:\Windows\system32\RacRules.xml
2014-10-25 12:00 - 2009-06-10 22:40 - 00146389 _____ () C:\Windows\SysWOW64\printmanagement.msc
2014-10-25 12:00 - 2009-06-10 22:39 - 00001041 _____ () C:\Windows\SysWOW64\tcpbidi.xml
2014-10-25 11:54 - 2014-11-06 17:14 - 00002008 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2014-10-25 11:54 - 2014-10-31 23:54 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-10-25 11:54 - 2014-10-31 23:54 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2014-10-25 11:54 - 2014-10-25 11:54 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-10-25 11:54 - 2014-10-25 11:54 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-10-25 11:54 - 2014-10-25 11:54 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-10-25 11:54 - 2014-10-25 11:54 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-10-25 11:54 - 2014-10-25 11:54 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-10-25 11:54 - 2014-10-25 11:54 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-10-25 11:54 - 2014-10-25 11:54 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-10-25 11:54 - 2014-10-25 11:54 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-10-25 11:54 - 2014-10-25 11:54 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-10-25 11:54 - 2014-10-25 11:54 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\AVAST Software
2014-10-25 11:54 - 2014-10-25 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-10-25 11:54 - 2014-10-25 11:54 - 00000000 ____D () C:\Program Files\AVAST Software
2014-10-25 11:53 - 2014-10-25 11:54 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-10-25 11:50 - 2014-10-02 14:53 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-25 11:50 - 2010-02-23 09:16 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\browserchoice.exe
2014-10-25 11:49 - 2014-10-25 11:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-25 11:49 - 2014-10-03 09:02 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-25 11:48 - 2011-04-09 07:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2014-10-25 11:48 - 2011-04-09 06:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2014-10-25 11:47 - 2014-10-25 11:51 - 131078000 _____ (AVAST Software) C:\Users\SiXidE\Downloads\avast_free_antivirus_setup.exe
2014-10-25 11:43 - 2014-10-25 11:43 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\ATI
2014-10-25 11:43 - 2014-10-25 11:43 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\ATI
2014-10-25 11:43 - 2014-10-25 11:43 - 00000000 ____D () C:\ProgramData\ATI
2014-10-25 11:43 - 2014-10-25 11:43 - 00000000 ____D () C:\ProgramData\AMD
2014-10-25 11:43 - 2014-10-25 11:43 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-10-25 11:43 - 2014-10-25 11:43 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-10-25 11:42 - 2014-10-25 14:32 - 01581880 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-10-25 11:42 - 2014-10-25 11:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-10-25 11:42 - 2014-10-25 11:42 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-10-25 11:42 - 2014-10-25 11:42 - 00000000 ____D () C:\Program Files\AMD
2014-10-25 11:42 - 2014-10-25 11:42 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-10-25 11:41 - 2014-10-26 09:47 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-25 11:41 - 2014-10-25 11:41 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-10-25 11:41 - 2014-10-25 11:41 - 00000000 ____D () C:\Program Files\ATI
2014-10-25 11:40 - 2014-10-25 11:40 - 00000000 ____D () C:\amd
2014-10-25 11:30 - 2014-10-25 11:30 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Mozilla
2014-10-25 11:30 - 2014-10-25 11:30 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\Mozilla
2014-10-25 11:30 - 2014-10-25 11:30 - 00000000 ____D () C:\ProgramData\Mozilla
2014-10-25 11:26 - 2014-11-07 22:31 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-10-25 11:26 - 2014-11-07 00:48 - 00110928 _____ () C:\Users\SiXidE\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-25 11:26 - 2014-10-25 11:26 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Intel Corporation
2014-10-25 11:26 - 2014-10-25 11:26 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\BMExplorer
2014-10-25 11:26 - 2014-10-25 11:26 - 00000000 ____D () C:\Users\Public\Documents\Atheros
2014-10-25 11:24 - 2014-10-30 11:50 - 00000000 ____D () C:\Users\SiXidE\Documents\Bluetooth Folder
2014-10-25 11:24 - 2014-10-25 11:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_btath_hcrp_01009.Wdf
2014-10-25 11:23 - 2014-10-25 11:24 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BT Program
2014-10-25 11:23 - 2014-10-25 11:23 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Marvell
2014-10-25 11:23 - 2014-10-25 11:23 - 00000000 ____D () C:\Program Files (x86)\Marvell
2014-10-25 11:23 - 2014-10-25 11:23 - 00000000 ____D () C:\Program Files (x86)\Bluetooth Suite
2014-10-25 11:22 - 2014-10-25 11:22 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2014-10-25 11:22 - 2010-11-05 22:45 - 00438808 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2014-10-25 11:21 - 2014-10-25 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Renesas Electronics
2014-10-25 11:21 - 2014-10-25 11:21 - 00000000 ____D () C:\Program Files (x86)\Renesas Electronics
2014-10-25 11:20 - 2011-06-10 05:34 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2014-10-25 11:19 - 2014-10-25 11:20 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-10-25 11:19 - 2014-10-25 11:19 - 00016896 _____ (ASUS) C:\Windows\AsTaskSched.dll
2014-10-25 11:19 - 2014-10-25 11:19 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-10-25 11:19 - 2014-10-25 11:19 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-10-25 11:19 - 2014-10-25 11:19 - 00000000 ____D () C:\Program Files\Realtek
2014-10-25 11:19 - 2010-11-02 12:33 - 02654824 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2014-10-25 11:19 - 2010-11-02 12:33 - 02536040 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-10-25 11:19 - 2010-11-02 12:33 - 02096232 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-10-25 11:19 - 2010-11-02 12:33 - 01146984 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-10-25 11:19 - 2010-11-02 12:33 - 00618600 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-10-25 11:19 - 2010-11-02 12:33 - 00332392 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-10-25 11:19 - 2010-11-02 12:33 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 01327208 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 01242728 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 01179752 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 01111656 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00561256 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2014-10-25 11:19 - 2010-11-02 12:32 - 00504936 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00491112 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00475752 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00317032 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00269928 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00266856 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00126056 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00125544 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00125032 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2014-10-25 11:19 - 2010-11-02 12:32 - 00082024 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInst64.dll
2014-10-25 11:19 - 2010-10-29 03:05 - 00118464 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2014-10-25 11:19 - 2010-10-28 03:46 - 01251944 ____R (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2014-10-25 11:19 - 2010-10-26 06:03 - 01937312 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-10-25 11:19 - 2010-10-26 02:16 - 01716368 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2014-10-25 11:19 - 2010-10-26 02:15 - 00419472 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2014-10-25 11:19 - 2010-10-26 02:15 - 00125584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2014-10-25 11:19 - 2010-10-26 02:15 - 00106640 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2014-10-25 11:19 - 2010-10-26 02:15 - 00072336 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2014-10-25 11:19 - 2010-10-04 09:12 - 02580824 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
2014-10-25 11:19 - 2010-10-04 09:12 - 01770328 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2014-10-25 11:19 - 2010-10-03 06:46 - 00341336 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2014-10-25 11:19 - 2010-09-27 02:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2014-10-25 11:19 - 2010-07-22 09:48 - 00220496 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFNHK64.dll
2014-10-25 11:19 - 2010-07-22 09:48 - 00081232 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFCOM64.dll
2014-10-25 11:19 - 2010-07-22 09:48 - 00078160 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFAPO64.dll
2014-10-25 11:19 - 2010-07-22 09:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2014-10-25 11:19 - 2010-07-22 09:37 - 00200800 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-10-25 11:19 - 2010-05-06 10:34 - 00334680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2014-10-25 11:19 - 2009-12-15 11:26 - 00372936 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-10-25 11:19 - 2009-12-15 11:26 - 00201928 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-10-25 11:19 - 2009-12-15 11:26 - 00099016 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-10-25 11:19 - 2009-12-15 11:26 - 00076488 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-10-25 11:19 - 2009-12-11 02:55 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-10-25 11:19 - 2009-12-11 02:55 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-10-25 11:19 - 2009-11-24 02:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2014-10-25 11:19 - 2009-11-24 02:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2014-10-25 11:19 - 2009-11-24 02:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2014-10-25 11:19 - 2009-11-24 02:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2014-10-25 11:19 - 2009-11-18 11:42 - 02197264 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2014-10-25 11:19 - 2009-11-17 11:12 - 00108960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-10-25 11:17 - 2014-10-25 12:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-10-25 11:17 - 2014-10-25 11:22 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-10-25 11:17 - 2014-10-25 11:17 - 00000000 ____D () C:\Users\SiXidE\AppData\Roaming\InstallShield
2014-10-25 11:17 - 2011-02-01 12:06 - 00008192 _____ () C:\Windows\system32\Drivers\IntelMEFWVer.dll
2014-10-25 11:17 - 2010-10-19 15:34 - 00056344 _____ (Intel Corporation) C:\Windows\system32\Drivers\HECIx64.sys
2014-10-25 11:17 - 2010-10-04 06:02 - 00053248 ____R (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2014-10-25 11:16 - 2014-10-25 11:21 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-10-25 11:16 - 2014-10-25 11:16 - 00027946 _____ () C:\Windows\Ascd_tmp.ini
2014-10-25 11:16 - 2014-10-25 11:16 - 00000000 ____D () C:\Intel
2014-10-25 11:15 - 2014-11-07 23:22 - 00000000 ____D () C:\Users\SiXidE
2014-10-25 11:15 - 2014-11-07 12:11 - 01869645 _____ () C:\Windows\WindowsUpdate.log
2014-10-25 11:15 - 2014-10-31 12:08 - 00000000 ____D () C:\Users\SiXidE\AppData\Local\VirtualStore
2014-10-25 11:15 - 2014-10-25 14:21 - 00001425 _____ () C:\Users\SiXidE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-25 11:15 - 2014-10-25 11:15 - 00000020 ___SH () C:\Users\SiXidE\ntuser.ini
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Vorlagen
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Startmenü
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Netzwerkumgebung
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Lokale Einstellungen
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Eigene Dateien
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Druckumgebung
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Documents\Eigene Musik
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Documents\Eigene Bilder
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\AppData\Local\Verlauf
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\AppData\Local\Anwendungsdaten
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\SiXidE\Anwendungsdaten
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Programme
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\ProgramData\Favoriten
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-10-25 11:15 - 2014-10-25 11:15 - 00000000 __SHD () C:\Recovery
2014-10-25 11:15 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\SiXidE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-25 11:15 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\SiXidE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-10-25 11:09 - 2014-10-25 11:09 - 00001345 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2014-10-25 11:09 - 2014-10-25 11:09 - 00001326 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2014-10-25 11:09 - 2014-10-25 11:09 - 00001313 _____ () C:\Windows\TSSysprep.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-07 12:15 - 2009-07-14 05:45 - 00015152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-07 12:15 - 2009-07-14 05:45 - 00015152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-07 12:13 - 2009-07-14 18:58 - 00688802 _____ () C:\Windows\system32\perfh007.dat
2014-11-07 12:13 - 2009-07-14 18:58 - 00148774 _____ () C:\Windows\system32\perfc007.dat
2014-11-07 12:13 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-07 12:08 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-07 12:08 - 2009-07-14 05:51 - 00025341 _____ () C:\Windows\setupact.log
2014-11-07 10:06 - 2009-07-14 05:45 - 05033008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-02 10:10 - 2009-07-14 19:18 - 00000000 ____D () C:\Windows\ShellNew
2014-11-02 10:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-11-02 10:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-11-02 10:08 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-10-30 12:11 - 2009-07-14 03:34 - 00017570 _____ () C:\Windows\system32\Drivers\etc\services
2014-10-27 00:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-25 15:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-10-25 14:39 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-25 14:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-10-25 14:27 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-10-25 14:21 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-10-25 14:18 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal
2014-10-25 14:18 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender
2014-10-25 14:18 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-10-25 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK
2014-10-25 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR
2014-10-25 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-10-25 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\zh-HK
2014-10-25 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\tr-TR
2014-10-25 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-10-25 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-10-25 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-10-25 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Portable Devices
2014-10-25 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2014-10-25 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\DVD Maker
2014-10-25 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar
2014-10-25 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices
2014-10-25 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\sppui
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Setup
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\migwiz
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\manifeststore
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\AdvancedInstallers
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sppui
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Setup
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\oobe
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\migwiz
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\manifeststore
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2014-10-25 12:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\servicing
2014-10-25 12:06 - 2009-07-14 06:38 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2014-10-25 12:06 - 2009-07-14 06:32 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2014-10-25 12:04 - 2009-07-14 03:36 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2014-10-25 12:04 - 2009-07-14 03:36 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll
2014-10-25 11:24 - 2010-10-20 04:01 - 00246804 _____ () C:\Windows\system32\Drivers\AtherosBt.bin
2014-10-25 11:19 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\restore
2014-10-25 11:15 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-10-25 11:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Windows NT
2014-10-25 11:09 - 2009-07-14 05:46 - 00001774 _____ () C:\Windows\DtcInstall.log
2014-10-25 11:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sysprep
2014-10-25 11:07 - 2009-07-14 19:18 - 00000000 ____D () C:\Windows\CSC

Some content of TEMP:
====================
C:\Users\SiXidE\AppData\Local\Temp\Quarantine.exe
C:\Users\SiXidE\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-05 02:36

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-11-2014
Ran by SiXidE at 2014-11-07 23:37:19
Running from C:\Users\SiXidE\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat X Pro - English, Franзais, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.1 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Master Collection (HKLM-x32\...\{E8AD3069-9EB7-4BA8-8BFE-83F4E69355C0}) (Version: 6 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Widget Browser (HKLM-x32\...\com.adobe.WidgetBrowser) (Version: 2.0 Build 348 - Adobe Systems Incorporated.)
AMD Catalyst Install Manager (HKLM\...\{C2956908-53A3-88FC-B795-B16508296FC4}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Autodesk 3ds Max 2015 (HKLM\...\Autodesk 3ds Max 2015) (Version: 17.2.259.0 - Autodesk)
Autodesk 3ds Max 2015 (Version: 17.2.259.0 - Autodesk) Hidden
Autodesk 3ds Max 2015 Ext 1 (HKLM\...\{8F59FEA4-DB31-47EF-1064-7E7954437F21}) (Version: 17.0.0.0 - Autodesk)
Autodesk 3ds Max 2015 Populate Data (HKLM\...\{57E92DED-DC6C-41E5-B9E1-76D83BD2EABE}) (Version: 17.0.0.0 - Autodesk)
Autodesk 3ds Max 2015 SP2 (HKLM\...\Autodesk 3ds Max 2015 SP2) (Version: 17.2.259.0 - Autodesk)
Autodesk Application Manager (HKLM-x32\...\Autodesk Application Manager) (Version: 1.0.59.0 - Autodesk)
Autodesk Backburner 2015 (HKLM-x32\...\{8C5F38D2-8EFE-49A4-B3F5-BF3210FED168}) (Version: 15.0.0.0 - Autodesk)
Autodesk DirectConnect 2015 64-bit (HKLM\...\Autodesk DirectConnect 2015 64-bit) (Version: 9.0.56.4 - Autodesk)
Autodesk DirectConnect 2015 64-bit (Version: 9.0.56.4 - Autodesk) Hidden
Autodesk Inventor Server Engine for 3ds Max 2015 (HKLM\...\{9167CA34-4E48-49E3-8892-3C439739D2D3}) (Version: 17.0 - Autodesk)
Autodesk Material Library 2015 (HKLM-x32\...\{427F733F-4D6C-45BC-9324-EB743104C321}) (Version: 5.2.9.100 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2015 (HKLM-x32\...\{ABE2F70B-8D94-44E9-AA04-F0DB35063D62}) (Version: 5.2.9.100 - Autodesk)
Autodesk Material Library Medium Resolution Image Library 2015 (HKLM-x32\...\{9F6466D9-6EFC-4A10-B931-C72D1A3F1763}) (Version: 5.2.9.100 - Autodesk)
Autodesk Revit Interoperability for 3ds Max 2015 (HKLM\...\Autodesk Revit Interoperability for 3ds Max 2015) (Version: 15.0.107.0 - Autodesk)
Autodesk Revit Interoperability for 3ds Max 2015 (Version: 15.0.107.0 - Autodesk) Hidden
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2206 - AVAST Software)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.40 - Atheros Communications)
Camtasia Studio 8 (HKLM-x32\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
Hercules Classic Link (HKLM-x32\...\{B1549CC1-EB81-4E7C-9C7C-8B97CD9FD37A}) (Version: 3.2.2.1 - Hercules)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
K-Lite Codec Pack 10.1.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.1.0 - )
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
ManyCam 4.0.109 (HKLM-x32\...\ManyCam) (Version: 4.0.109 - Visicom Media Inc.)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1051 - Marvell)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 33.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.3 (x86 de)) (Version: 33.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0.2 - Mozilla)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.17.22533 - Razer Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.37.1229.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6235 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
V-Ray for 3dsmax 2015 for x64 (HKLM\...\V-Ray for 3dsmax 2015 for x64) (Version: 2.50.01 - Chaos Software Ltd)
Wacom Tablett (HKLM\...\Wacom Tablet Driver) (Version: 6.3.9w5 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WinRAR 5.11 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version:  - )
ZBrush 4R6 (HKLM-x32\...\ZBrush 4R6 4R6) (Version: 4R6 - Pixologic)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2053263401-3595949893-2862785971-1000_Classes\CLSID\{073CB204-6B29-46FC-AB98-451F1D068741}\InprocServer32 -> C:\Program Files\Autodesk\3ds Max 2015\Inventor Server\Bin\TestServer.dll No File
CustomCLSID: HKU\S-1-5-21-2053263401-3595949893-2862785971-1000_Classes\CLSID\{8C23B656-4E6E-4B45-9920-9617168D39A3}\InprocServer32 -> C:\Program Files\Autodesk\3ds Max 2015\Inventor Server\Bin\TestServer.dll No File
CustomCLSID: HKU\S-1-5-21-2053263401-3595949893-2862785971-1000_Classes\CLSID\{E5B0515D-48D2-4F04-906D-0192ED65A2DD}\InprocServer32 -> C:\Program Files\Autodesk\3ds Max 2015\Inventor Server\Bin\TestServer.dll No File

==================== Restore Points  =========================

26-10-2014 08:44:45 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
26-10-2014 08:45:04 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
26-10-2014 08:45:35 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727
26-10-2014 08:45:53 DirectX wurde installiert
26-10-2014 08:47:06 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
26-10-2014 22:08:49 Camtasia Studio 8 wird installiert
30-10-2014 10:28:08 Gerätetreiber-Paketinstallation: Visicom Media Inc. Bildverarbeitungsgeräte
30-10-2014 10:28:18 Gerätetreiber-Paketinstallation: Visicom Media Inc. Audio-, Video- und Gamecontroller
02-11-2014 09:08:31 Installed Microsoft Office Enterprise 2007
04-11-2014 16:48:14 Removed Java 8 Update 25

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-02-11 01:11 - 00005284 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 3dns.adobe.com
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com
127.0.0.1 activate.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sea.adobe.com.*
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 activate.wip.adobe.com
127.0.0.1 activate.wip1.adobe.com
127.0.0.1 activate.wip2.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 activate.wip4.adobe.com
127.0.0.1 adobe-dns.adobe.com

There are 116 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3637D3B4-4652-457D-AD4F-19424C562186} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {3A8229BF-086D-4854-967D-A3EC1AE9F2B2} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {4051719C-53C3-4CD4-AF6E-B220F0231B87} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {4866D108-F0A9-43B2-BC68-825B174B4D6A} - System32\Tasks\AdobeAAMUpdater-1.0-SiXidE-PC-SiXidE => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {722D8A1C-E076-4D79-BB86-75CE70CBE198} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {AF9EECCF-64CA-4D1E-8640-2932562CC412} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-10-25] (AVAST Software)
Task: {D6A88156-7CD3-47BF-AD87-7F0627A174D0} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {D7DE6C8D-DBE1-4941-9426-1E719D4FE2C3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {DB133125-CD24-42F9-B609-4CD7B9D35C8F} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {FA6E040F-73C1-4894-8B73-7BE54C01F6CB} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {FD33CEE6-4862-4AB2-B82B-E3E122424E99} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe

==================== Loaded Modules (whitelisted) =============

2014-11-06 20:59 - 2014-10-27 22:38 - 01356568 _____ () C:\Program Files\Tablet\Wacom\libxml2.dll
2014-11-07 01:18 - 2014-11-07 01:18 - 02899456 _____ () C:\Program Files\AVAST Software\Avast\defs\14110601\algo.dll
2014-11-07 12:09 - 2014-11-07 12:09 - 02900480 _____ () C:\Program Files\AVAST Software\Avast\defs\14110700\algo.dll
2014-10-26 09:46 - 2013-12-22 07:22 - 00047496 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\QtSolutions_Service-head.dll
2014-10-26 09:46 - 2013-12-22 07:22 - 00104328 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\qjson0.dll
2014-10-30 11:58 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-10-30 11:58 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-10-30 11:58 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-10-30 11:58 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-10-30 11:58 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-10-25 11:54 - 2014-10-25 11:54 - 38561576 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-11-07 12:09 - 2013-12-22 07:22 - 00104328 _____ () C:\Users\SiXidE\AppData\Local\Autodesk\.AdskAppManager\R1\qjson0.dll
2014-10-25 15:02 - 2014-10-25 15:02 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2014-10-25 11:22 - 2010-11-05 22:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-11-07 01:24 - 2014-11-07 01:24 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-10-25 13:24 - 2014-10-25 13:24 - 16832176 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll
2012-11-14 04:22 - 2012-11-14 04:22 - 02010624 _____ () C:\Program Files (x86)\ManyCam\opencv_core220.dll
2012-11-14 04:23 - 2012-11-14 04:23 - 01241088 _____ () C:\Program Files (x86)\ManyCam\opencv_imgproc220.dll
2012-11-14 04:23 - 2012-11-14 04:23 - 00241152 _____ () C:\Program Files (x86)\ManyCam\opencv_objdetect220.dll
2012-11-14 04:23 - 2012-11-14 04:23 - 00775680 _____ () C:\Program Files (x86)\ManyCam\opencv_highgui220.dll
2012-11-14 04:23 - 2012-11-14 04:23 - 00201216 _____ () C:\Program Files (x86)\ManyCam\opencv_video220.dll
2014-10-25 20:40 - 2013-10-25 19:00 - 01233920 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\avformat-lav-55.dll
2014-10-25 20:40 - 2013-10-25 19:00 - 08102912 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\avcodec-lav-55.dll
2014-10-25 20:40 - 2013-10-25 19:00 - 00358400 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\avutil-lav-52.dll
2014-10-25 20:40 - 2013-10-25 19:00 - 00235008 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\libbluray.dll
2014-10-25 20:40 - 2013-10-25 19:00 - 00385024 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\swscale-lav-2.dll
2014-10-25 20:40 - 2013-10-25 19:00 - 00212992 _____ () C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\avfilter-lav-3.dll
2012-03-13 11:35 - 2012-03-13 11:35 - 01718784 _____ () D:\programme\Camtasia\QtCore4.dll
2012-03-13 11:43 - 2012-03-13 11:43 - 06103552 _____ () D:\programme\Camtasia\QtGui4.dll
2013-08-21 02:04 - 2013-08-21 02:04 - 02826368 _____ () D:\programme\Camtasia\ConsumerRestoration_Win32.dll
2013-08-21 02:04 - 2013-08-21 02:04 - 02259456 _____ () D:\programme\Camtasia\SingleBandCompressor_Win32.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2053263401-3595949893-2862785971-500 - Administrator - Disabled)
Gast (S-1-5-21-2053263401-3595949893-2862785971-501 - Limited - Disabled)
SiXidE (S-1-5-21-2053263401-3595949893-2862785971-1000 - Administrator - Enabled) => C:\Users\SiXidE

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/07/2014 00:35:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17344, Zeitstempel: 0x541b6f63
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000001c
ID des fehlerhaften Prozesses: 0x4b0
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (11/06/2014 11:01:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WSCommCntr4.exe, Version: 4.0.3.0, Zeitstempel: 0x52e23951
Name des fehlerhaften Moduls: WSCommCntr4.exe, Version: 4.0.3.0, Zeitstempel: 0x52e23951
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000015a1e
ID des fehlerhaften Prozesses: 0x27fc
Startzeit der fehlerhaften Anwendung: 0xWSCommCntr4.exe0
Pfad der fehlerhaften Anwendung: WSCommCntr4.exe1
Pfad des fehlerhaften Moduls: WSCommCntr4.exe2
Berichtskennung: WSCommCntr4.exe3


System errors:
=============
Error: (11/07/2014 00:48:11 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (11/07/2014 00:28:49 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (11/06/2014 09:00:37 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (11/06/2014 04:58:07 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz
Percentage of memory in use: 30%
Total physical RAM: 16351.15 MB
Available physical RAM: 11297.43 MB
Total Pagefile: 32700.48 MB
Available Pagefile: 27028.82 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.66 GB) (Free:155.37 GB) NTFS
Drive d: (Volume) (Fixed) (Total:558.91 GB) (Free:87.86 GB) NTFS
Drive e: (Resources) (Fixed) (Total:931.51 GB) (Free:60.47 GB) NTFS
Drive f: (Tutorials) (Fixed) (Total:931.41 GB) (Free:104.15 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 558.9 GB) (Disk ID: 9828C270)
Partition 1: (Not Active) - (Size=558.9 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 611505CF)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 26DF92BD)
Partition 1: (Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-07 23:44:52
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.EXT0 232,89GB
Running: cmzs6r28.exe; Driver: C:\Users\SiXidE\AppData\Local\Temp\pwdiqpod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                       00000000779f1360 5 bytes JMP 000000014a570460
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                00000000779f13b0 5 bytes JMP 000000014a570450
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                00000000779f1510 5 bytes JMP 000000014a570370
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                     00000000779f1560 5 bytes JMP 000000014a570470
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                           00000000779f1570 5 bytes JMP 000000014a5703e0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                00000000779f1620 5 bytes JMP 000000014a570320
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                         00000000779f1650 5 bytes JMP 000000014a5703b0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                            00000000779f1670 5 bytes JMP 000000014a570390
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                  00000000779f16b0 5 bytes JMP 000000014a5702e0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                00000000779f1730 5 bytes JMP 000000014a5702d0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                              00000000779f1750 5 bytes JMP 000000014a570310
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                               00000000779f1790 5 bytes JMP 000000014a5703c0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                            00000000779f17e0 5 bytes JMP 000000014a5703f0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                               00000000779f1940 5 bytes JMP 000000014a570230
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                    00000000779f1b00 5 bytes JMP 000000014a570480
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                   00000000779f1b30 5 bytes JMP 000000014a5703a0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                            00000000779f1c10 5 bytes JMP 000000014a5702f0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                         00000000779f1c20 5 bytes JMP 000000014a570350
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                               00000000779f1c80 5 bytes JMP 000000014a570290
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                            00000000779f1d10 5 bytes JMP 000000014a5702b0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                             00000000779f1d30 5 bytes JMP 000000014a5703d0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                00000000779f1d40 5 bytes JMP 000000014a570330
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                         00000000779f1db0 5 bytes JMP 000000014a570410
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                            00000000779f1de0 5 bytes JMP 000000014a570240
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                 00000000779f20a0 5 bytes JMP 000000014a5701e0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                            00000000779f2160 5 bytes JMP 000000014a570250
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                            00000000779f2190 5 bytes JMP 000000014a570490
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                   00000000779f21a0 5 bytes JMP 000000014a5704a0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                              00000000779f21d0 5 bytes JMP 000000014a570300
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                           00000000779f21e0 5 bytes JMP 000000014a570360
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                 00000000779f2240 5 bytes JMP 000000014a5702a0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                              00000000779f2290 5 bytes JMP 000000014a5702c0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                 00000000779f22c0 5 bytes JMP 000000014a570380
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                  00000000779f22d0 5 bytes JMP 000000014a570340
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                           00000000779f25c0 5 bytes JMP 000000014a570440
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                          00000000779f27c0 5 bytes JMP 000000014a570260
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                             00000000779f27d0 5 bytes JMP 000000014a570270
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                           00000000779f27e0 5 bytes JMP 000000014a570400
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                       00000000779f29a0 5 bytes JMP 000000014a5701f0
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                        00000000779f29b0 5 bytes JMP 000000014a570210
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                             00000000779f2a20 5 bytes JMP 000000014a570200
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                             00000000779f2a80 5 bytes JMP 000000014a570420
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                              00000000779f2a90 5 bytes JMP 000000014a570430
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                         00000000779f2aa0 5 bytes JMP 000000014a570220
.text  C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                 00000000779f2b80 5 bytes JMP 000000014a570280
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                       00000000779f1360 5 bytes JMP 000000014a570460
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                00000000779f13b0 5 bytes JMP 000000014a570450
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                00000000779f1510 5 bytes JMP 000000014a570370
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                     00000000779f1560 5 bytes JMP 000000014a570470
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                           00000000779f1570 5 bytes JMP 000000014a5703e0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                00000000779f1620 5 bytes JMP 000000014a570320
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                         00000000779f1650 5 bytes JMP 000000014a5703b0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                            00000000779f1670 5 bytes JMP 000000014a570390
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                  00000000779f16b0 5 bytes JMP 000000014a5702e0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                00000000779f1730 5 bytes JMP 000000014a5702d0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                              00000000779f1750 5 bytes JMP 000000014a570310
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                               00000000779f1790 5 bytes JMP 000000014a5703c0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                            00000000779f17e0 5 bytes JMP 000000014a5703f0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                               00000000779f1940 5 bytes JMP 000000014a570230
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                    00000000779f1b00 5 bytes JMP 000000014a570480
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                   00000000779f1b30 5 bytes JMP 000000014a5703a0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                            00000000779f1c10 5 bytes JMP 000000014a5702f0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                         00000000779f1c20 5 bytes JMP 000000014a570350
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                               00000000779f1c80 5 bytes JMP 000000014a570290
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                            00000000779f1d10 5 bytes JMP 000000014a5702b0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                             00000000779f1d30 5 bytes JMP 000000014a5703d0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                00000000779f1d40 5 bytes JMP 000000014a570330
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                         00000000779f1db0 5 bytes JMP 000000014a570410
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                            00000000779f1de0 5 bytes JMP 000000014a570240
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                 00000000779f20a0 5 bytes JMP 000000014a5701e0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                            00000000779f2160 5 bytes JMP 000000014a570250
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                            00000000779f2190 5 bytes JMP 000000014a570490
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                   00000000779f21a0 5 bytes JMP 000000014a5704a0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                              00000000779f21d0 5 bytes JMP 000000014a570300
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                           00000000779f21e0 5 bytes JMP 000000014a570360
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                 00000000779f2240 5 bytes JMP 000000014a5702a0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                              00000000779f2290 5 bytes JMP 000000014a5702c0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                 00000000779f22c0 5 bytes JMP 000000014a570380
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                  00000000779f22d0 5 bytes JMP 000000014a570340
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                           00000000779f25c0 5 bytes JMP 000000014a570440
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                          00000000779f27c0 5 bytes JMP 000000014a570260
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                             00000000779f27d0 5 bytes JMP 000000014a570270
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                           00000000779f27e0 5 bytes JMP 000000014a570400
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                       00000000779f29a0 5 bytes JMP 000000014a5701f0
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                        00000000779f29b0 5 bytes JMP 000000014a570210
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                             00000000779f2a20 5 bytes JMP 000000014a570200
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                             00000000779f2a80 5 bytes JMP 000000014a570420
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                              00000000779f2a90 5 bytes JMP 000000014a570430
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                         00000000779f2aa0 5 bytes JMP 000000014a570220
.text  C:\Windows\system32\csrss.exe[680] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                 00000000779f2b80 5 bytes JMP 000000014a570280
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\services.exe[728] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                       00000000779f1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                00000000779f13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                00000000779f1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                     00000000779f1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                           00000000779f1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                00000000779f1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                         00000000779f1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                            00000000779f1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                  00000000779f16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                00000000779f1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                              00000000779f1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                               00000000779f1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                            00000000779f17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                               00000000779f1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                    00000000779f1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                   00000000779f1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                            00000000779f1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                         00000000779f1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                               00000000779f1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                            00000000779f1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                             00000000779f1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                00000000779f1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                         00000000779f1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                            00000000779f1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                 00000000779f20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                            00000000779f2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                            00000000779f2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                   00000000779f21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                              00000000779f21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                           00000000779f21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                 00000000779f2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                              00000000779f2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                 00000000779f22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                  00000000779f22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                           00000000779f25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                          00000000779f27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                             00000000779f27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                           00000000779f27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                       00000000779f29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                        00000000779f29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                             00000000779f2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                             00000000779f2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                              00000000779f2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                         00000000779f2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\lsass.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                 00000000779f2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                         00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                  00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                  00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                       00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                             00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                  00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                           00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                              00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                    00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                  00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                 00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                              00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                 00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                      00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                     00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                              00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                           00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                 00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                              00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                               00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                  00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                           00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                              00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                   00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                              00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                              00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                     00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                                00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                             00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                   00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                                00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                   00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                    00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                             00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                            00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                               00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                             00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                         00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                          00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                               00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                               00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                           00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\lsm.exe[756] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                   00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\svchost.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\winlogon.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess
         

GMER

.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\System32\svchost.exe[876] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\svchost.exe[1056] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                   00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                            00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                            00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                 00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                       00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                            00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                     00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                        00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                              00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                            00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                          00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                           00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                        00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                           00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                               00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                        00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                     00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                           00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                        00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                         00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                            00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                     00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                        00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                             00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                        00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                        00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                               00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                          00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                       00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                             00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                          00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                             00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                              00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                       00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                      00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                         00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                       00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                   00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                    00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                         00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                         00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                          00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                     00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\atieclxx.exe[1312] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                             00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1384] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\svchost.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\System32\spoolsv.exe[1980] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\svchost.exe[2008] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000100070280
.text  C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe[2392] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                       0000000076ca1465 2 bytes [CA, 76]
.text  C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe[2392] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                      0000000076ca14bb 2 bytes [CA, 76]
.text  ...                                                                                                                                                           * 2
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2676] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                  0000000076ca1465 2 bytes [CA, 76]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2676] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                 0000000076ca14bb 2 bytes [CA, 76]
.text  ...                                                                                                                                                           * 2
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                              00000000779f1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                       00000000779f13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       00000000779f1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                            00000000779f1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  00000000779f1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       00000000779f1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory
         

GMER

.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   00000000779f1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                         00000000779f16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       00000000779f1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     00000000779f1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      00000000779f1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                   00000000779f17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                      00000000779f1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                           00000000779f1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                          00000000779f1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                   00000000779f1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                00000000779f1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      00000000779f1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                   00000000779f1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    00000000779f1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                       00000000779f1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                00000000779f1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                   00000000779f1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000779f20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                   00000000779f2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                   00000000779f2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                          00000000779f21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                     00000000779f21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                  00000000779f21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                        00000000779f2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                     00000000779f2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                        00000000779f22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                         00000000779f22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                  00000000779f25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                 00000000779f27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                    00000000779f27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  00000000779f27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000779f29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                               00000000779f29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                    00000000779f2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    00000000779f2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                     00000000779f2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                00000000779f2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\wbem\wmiprvse.exe[1940] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                        00000000779f2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\svchost.exe[3664] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                   00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                            00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                            00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                 00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                       00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                            00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                     00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                        00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                              00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                            00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                          00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                           00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                        00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                           00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                               00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                        00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                     00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                           00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                        00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                         00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                            00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                     00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                        00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                             00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                        00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                        00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                               00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                          00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                       00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                             00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                          00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                             00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                              00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                       00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                      00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                         00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                       00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                   00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                    00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                         00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                         00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                          00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                     00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\taskhost.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                             00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                            00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                     00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                     00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                          00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                     00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                              00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                 00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                       00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                     00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                   00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                    00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                 00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                    00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                         00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                        00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                                 00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                              00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                    00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                                 00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                  00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                     00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                              00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                                 00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                      00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                                 00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                                 00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                        00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                                   00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                                00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                      00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                                   00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                      00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                       00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                                00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                               00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                                  00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                            00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                             00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                                  00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                  00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                   00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                              00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\Explorer.EXE[3652] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                      00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                 00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                          00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                          00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                               00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                     00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                          00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                      00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                            00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                          00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                        00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                         00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                      00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                         00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                              00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                             00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                      00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                   00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                         00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                      00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                          00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                   00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                      00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                           00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                      00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                      00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                             00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                        00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                     00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                           00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                        00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                           00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                            00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                     00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                    00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                       00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                 00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                  00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                       00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                       00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                        00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                   00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe[3188] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                           00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                  00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                           00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                           00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                      00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                           00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                    00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                       00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                             00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                           00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                         00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                          00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                       00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                          00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                               00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                              00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                       00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                    00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                          00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                       00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                        00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                           00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                    00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                       00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                            00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                       00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                       00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                              00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                         00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                      00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                            00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                         00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                            00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                             00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                      00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                     00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                        00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                      00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                  00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                   00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                        00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                        00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                         00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                    00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe[4228] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                            00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                     00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                              00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                              00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                   00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                         00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                              00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                       00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                          00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                              00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                            00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                             00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                          00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                             00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                  00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                 00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                          00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                       00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                             00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                          00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                           00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                              00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                       00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                          00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                               00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                          00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                          00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                 00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                            00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                         00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                               00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                            00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                               00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                         00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                        00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                           00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                         00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                     00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                      00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                           00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                           00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                            00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                       00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe[4244] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                               00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                         00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                         00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                              00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                    00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                         00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                  00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                     00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                           00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                         00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                       00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                        00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                     00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                        00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                             00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                            00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                     00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                  00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                        00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                     00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                      00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                         00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                  00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                     00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                          00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                     00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                     00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                            00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                       00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                    00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                          00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                       00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                          00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                           00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                    00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                   00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                      00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                    00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                 00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                      00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                      00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                       00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                  00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                          00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                               00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                        00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                        00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                             00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                   00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                        00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                 00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                    00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                          00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                        00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                      00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                       00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                    00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                       00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                            00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                           00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                    00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                 00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                       00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                    00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                     00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                        00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                 00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                    00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                         00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                    00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                    00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                           00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                      00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                   00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                         00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                      00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                         00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                          00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                   00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                  00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                     00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                   00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                               00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                     00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                     00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                      00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                 00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4756] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                         00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\AVAST Software\Avast\avastui.exe[4876] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                          0000000076da8791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text  C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe[4964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                              0000000076ca1465 2 bytes [CA, 76]
.text  C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe[4964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                             0000000076ca14bb 2 bytes [CA, 76]
.text  ...                                                                                                                                                           * 2
.text  C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe[4720] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                              0000000076ca1465 2 bytes [CA, 76]
.text  C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe[4720] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                             0000000076ca14bb 2 bytes [CA, 76]
.text  ...                                                                                                                                                           * 2
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                   0000000076ca1465 2 bytes [CA, 76]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                  0000000076ca14bb 2 bytes [CA, 76]
.text  ...                                                                                                                                                           * 2
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                              00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                       00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                            00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                         00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                   00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                      00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                           00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                          00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                   00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                   00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                       00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                   00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                   00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                   00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                          00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                     00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                  00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                        00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                     00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                        00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                         00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                  00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                 00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                    00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                               00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                    00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                     00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\SearchIndexer.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl
         

GMER

.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\taskeng.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[4352] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4896] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                     00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                              00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                              00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                   00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                         00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                              00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                       00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                          00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                              00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                            00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                             00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                          00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                             00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                  00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                 00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                          00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                       00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                             00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                          00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                           00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                              00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                       00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                          00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                               00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                          00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                          00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                 00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                            00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                         00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                               00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                            00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                               00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                         00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                        00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                           00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                         00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                     00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                      00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                           00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                           00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                            00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                       00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[5148] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                               00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[5160] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                 00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                          00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                          00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                               00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                     00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                          00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                      00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                            00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                          00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                        00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                         00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                      00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                         00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                              00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                             00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                      00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                   00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                         00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                      00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                          00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                   00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                      00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                           00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                      00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                      00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                             00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                        00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                     00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                           00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                        00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                           00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                            00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                     00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                    00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                       00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                 00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                  00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                       00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                       00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                        00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                   00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Windows Media Player\wmpnetwk.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                           00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                        00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                 00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                 00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                      00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                            00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                 00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                          00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                             00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                   00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                 00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                               00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                             00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                     00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                    00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                             00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                          00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                             00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                              00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                 00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                          00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                             00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                  00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                             00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                             00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                    00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                               00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                            00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                  00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                               00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                  00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                   00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                            00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                           00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                              00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                            00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                        00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                         00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                              00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                              00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                               00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                          00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                  00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\wuauclt.exe[5228] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                    00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                             00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                             00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                  00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                             00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                         00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                               00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                             00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                           00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                            00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                         00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                            00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                 00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                         00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                      00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                            00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                         00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                             00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                      00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                         00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                              00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                         00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                         00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                           00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                        00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                              00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                           00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                              00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                               00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                        00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                       00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                          00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                    00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                     00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                          00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                          00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                           00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                      00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\system32\AUDIODG.EXE[5056] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                              00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                           00000000779f1360 5 bytes JMP 0000000077b50460
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                    00000000779f13b0 5 bytes JMP 0000000077b50450
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                    00000000779f1510 5 bytes JMP 0000000077b50370
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                         00000000779f1560 5 bytes JMP 0000000077b50470
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                               00000000779f1570 5 bytes JMP 0000000077b503e0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                    00000000779f1620 5 bytes JMP 0000000077b50320
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                             00000000779f1650 5 bytes JMP 0000000077b503b0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                00000000779f1670 5 bytes JMP 0000000077b50390
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                      00000000779f16b0 5 bytes JMP 0000000077b502e0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                    00000000779f1730 5 bytes JMP 0000000077b502d0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                  00000000779f1750 5 bytes JMP 0000000077b50310
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                   00000000779f1790 5 bytes JMP 0000000077b503c0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                00000000779f17e0 5 bytes JMP 0000000077b503f0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                   00000000779f1940 5 bytes JMP 0000000077b50230
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                        00000000779f1b00 5 bytes JMP 0000000077b50480
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                       00000000779f1b30 5 bytes JMP 0000000077b503a0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                                00000000779f1c10 5 bytes JMP 0000000077b502f0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                             00000000779f1c20 5 bytes JMP 0000000077b50350
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                   00000000779f1c80 5 bytes JMP 0000000077b50290
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                                00000000779f1d10 5 bytes JMP 0000000077b502b0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                 00000000779f1d30 5 bytes JMP 0000000077b503d0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                    00000000779f1d40 5 bytes JMP 0000000077b50330
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                             00000000779f1db0 5 bytes JMP 0000000077b50410
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                                00000000779f1de0 5 bytes JMP 0000000077b50240
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                     00000000779f20a0 5 bytes JMP 0000000077b501e0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                                00000000779f2160 5 bytes JMP 0000000077b50250
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                                00000000779f2190 5 bytes JMP 0000000077b50490
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                       00000000779f21a0 5 bytes JMP 0000000077b504a0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                                  00000000779f21d0 5 bytes JMP 0000000077b50300
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                               00000000779f21e0 5 bytes JMP 0000000077b50360
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                     00000000779f2240 5 bytes JMP 0000000077b502a0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                                  00000000779f2290 5 bytes JMP 0000000077b502c0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                     00000000779f22c0 5 bytes JMP 0000000077b50380
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                      00000000779f22d0 5 bytes JMP 0000000077b50340
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                               00000000779f25c0 5 bytes JMP 0000000077b50440
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                              00000000779f27c0 5 bytes JMP 0000000077b50260
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                                 00000000779f27d0 5 bytes JMP 0000000077b50270
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                               00000000779f27e0 5 bytes JMP 0000000077b50400
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                           00000000779f29a0 5 bytes JMP 0000000077b501f0
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                            00000000779f29b0 5 bytes JMP 0000000077b50210
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                                 00000000779f2a20 5 bytes JMP 0000000077b50200
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                 00000000779f2a80 5 bytes JMP 0000000077b50420
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                  00000000779f2a90 5 bytes JMP 0000000077b50430
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                             00000000779f2aa0 5 bytes JMP 0000000077b50220
.text  C:\Windows\explorer.exe[10284] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                     00000000779f2b80 5 bytes JMP 0000000077b50280
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 166  000000002fd51974 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 253  000000002fd519cb 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 320  000000002fd51a0e 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 390  000000002fd51a54 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 738  000000002fd51bb0 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 937  000000002fd51c77 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 958  000000002fd51c8c 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 970  000000002fd51c98 2 bytes [D5, 2F]
.text  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[5108] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                               0000000076da8791 5 bytes JMP 0000000131f95629
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      00000000779f1360 5 bytes JMP 0000000100070460
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               00000000779f13b0 5 bytes JMP 0000000100070450
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               00000000779f1510 5 bytes JMP 0000000100070370
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    00000000779f1560 5 bytes JMP 0000000100070470
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          00000000779f1570 5 bytes JMP 00000001000703e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               00000000779f1620 5 bytes JMP 0000000100070320
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        00000000779f1650 5 bytes JMP 00000001000703b0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           00000000779f1670 5 bytes JMP 0000000100070390
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 00000000779f16b0 5 bytes JMP 00000001000702e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               00000000779f1730 5 bytes JMP 00000001000702d0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             00000000779f1750 5 bytes JMP 0000000100070310
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              00000000779f1790 5 bytes JMP 00000001000703c0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           00000000779f17e0 5 bytes JMP 00000001000703f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              00000000779f1940 5 bytes JMP 0000000100070230
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   00000000779f1b00 5 bytes JMP 0000000100070480
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  00000000779f1b30 5 bytes JMP 00000001000703a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           00000000779f1c10 5 bytes JMP 00000001000702f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        00000000779f1c20 5 bytes JMP 0000000100070350
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              00000000779f1c80 5 bytes JMP 0000000100070290
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           00000000779f1d10 5 bytes JMP 00000001000702b0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            00000000779f1d30 5 bytes JMP 00000001000703d0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               00000000779f1d40 5 bytes JMP 0000000100070330
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        00000000779f1db0 5 bytes JMP 0000000100070410
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           00000000779f1de0 5 bytes JMP 0000000100070240
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                00000000779f20a0 5 bytes JMP 00000001000701e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           00000000779f2160 5 bytes JMP 0000000100070250
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           00000000779f2190 5 bytes JMP 0000000100070490
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  00000000779f21a0 5 bytes JMP 00000001000704a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             00000000779f21d0 5 bytes JMP 0000000100070300
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          00000000779f21e0 5 bytes JMP 0000000100070360
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                00000000779f2240 5 bytes JMP 00000001000702a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             00000000779f2290 5 bytes JMP 00000001000702c0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                00000000779f22c0 5 bytes JMP 0000000100070380
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 00000000779f22d0 5 bytes JMP 0000000100070340
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          00000000779f25c0 5 bytes JMP 0000000100070440
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         00000000779f27c0 5 bytes JMP 0000000100070260
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            00000000779f27d0 5 bytes JMP 0000000100070270
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          00000000779f27e0 5 bytes JMP 0000000100070400
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      00000000779f29a0 5 bytes JMP 00000001000701f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       00000000779f29b0 5 bytes JMP 0000000100070210
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            00000000779f2a20 5 bytes JMP 0000000100070200
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            00000000779f2a80 5 bytes JMP 0000000100070420
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             00000000779f2a90 5 bytes JMP 0000000100070430
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        00000000779f2aa0 5 bytes JMP 0000000100070220
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[5132] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                00000000779f2b80 5 bytes JMP 0000000100070280

---- EOF - GMER 2.1 ----
         

Here sind alle Logs. Der Virus hat sogar hier in meinen Posts eine Signatur hier erstellt. Leider weiss ich nicht wie ich die wegmachen kann...tut mir leid dafür und vielen Dank im Voraus!

hi,

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Gemacht, es wurden keine Rootkits gefunden...

18:37:36.0665 0x79fc  TDSS rootkit removing tool 3.0.0.41 Oct 28 2014 17:58:34
18:37:36.0666 0x79fc  UEFI system
18:38:26.0792 0x79fc  ============================================================
18:38:26.0792 0x79fc  Current date / time: 2014/11/09 18:38:26.0792
18:38:26.0792 0x79fc  SystemInfo:
18:38:26.0792 0x79fc  
18:38:26.0792 0x79fc  OS Version: 6.1.7601 ServicePack: 1.0
18:38:26.0792 0x79fc  Product type: Workstation
18:38:26.0792 0x79fc  ComputerName: SIXIDE-PC
18:38:26.0792 0x79fc  UserName: SiXidE
18:38:26.0792 0x79fc  Windows directory: C:\Windows
18:38:26.0792 0x79fc  System windows directory: C:\Windows
18:38:26.0792 0x79fc  Running under WOW64
18:38:26.0792 0x79fc  Processor architecture: Intel x64
18:38:26.0792 0x79fc  Number of processors: 8
18:38:26.0792 0x79fc  Page size: 0x1000
18:38:26.0792 0x79fc  Boot type: Normal boot
18:38:26.0792 0x79fc  ============================================================
18:38:40.0922 0x79fc  KLMD registered as C:\Windows\system32\drivers\83525681.sys
18:38:41.0068 0x79fc  System UUID: {A1096743-B2B2-90BA-CF85-259BCC96ACAC}
18:38:41.0486 0x79fc  Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:38:41.0498 0x79fc  Drive \Device\Harddisk1\DR1 - Size: 0x8BBA5F6000 ( 558.91 Gb ), SectorSize: 0x200, Cylinders: 0x11D01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:38:41.0498 0x79fc  Drive \Device\Harddisk2\DR2 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:38:41.0499 0x79fc  Drive \Device\Harddisk3\DR3 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:38:41.0503 0x79fc  ============================================================
18:38:41.0503 0x79fc  \Device\Harddisk0\DR0:
18:38:41.0503 0x79fc  GPT partitions:
18:38:41.0504 0x79fc  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {D4F1786D-B2BE-4F83-9451-927B0A0F009C}, Name: EFI system partition, StartLBA 0x800, BlocksNum 0x32000
18:38:41.0504 0x79fc  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {CD0CA712-FD9D-41CD-84BC-2F991DB4B4A5}, Name: Microsoft reserved partition, StartLBA 0x32800, BlocksNum 0x40000
18:38:41.0504 0x79fc  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {1DE4452B-89C5-4A64-993B-35A293246AE2}, Name: Basic data partition, StartLBA 0x72800, BlocksNum 0x1D153000
18:38:41.0504 0x79fc  MBR partitions:
18:38:41.0504 0x79fc  \Device\Harddisk1\DR1:
18:38:41.0504 0x79fc  MBR partitions:
18:38:41.0504 0x79fc  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x45DD1800
18:38:41.0504 0x79fc  \Device\Harddisk2\DR2:
18:38:41.0504 0x79fc  MBR partitions:
18:38:41.0504 0x79fc  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800
18:38:41.0504 0x79fc  \Device\Harddisk3\DR3:
18:38:41.0505 0x79fc  MBR partitions:
18:38:41.0505 0x79fc  \Device\Harddisk3\DR3\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
18:38:41.0505 0x79fc  ============================================================
18:38:41.0505 0x79fc  C: <-> \Device\Harddisk0\DR0\Partition3
18:38:41.0515 0x79fc  D: <-> \Device\Harddisk1\DR1\Partition1
18:38:41.0537 0x79fc  E: <-> \Device\Harddisk2\DR2\Partition1
18:38:41.0683 0x79fc  F: <-> \Device\Harddisk3\DR3\Partition1
18:38:41.0683 0x79fc  ============================================================
18:38:41.0683 0x79fc  Initialize success
18:38:41.0683 0x79fc  ============================================================
18:39:08.0441 0x587c  ============================================================
18:39:08.0441 0x587c  Scan started
18:39:08.0441 0x587c  Mode: Manual; SigCheck; TDLFS; 
18:39:08.0441 0x587c  ============================================================
18:39:08.0441 0x587c  KSN ping started
18:39:11.0363 0x587c  KSN ping finished: true
18:39:11.0908 0x587c  ================ Scan system memory ========================
18:39:11.0908 0x587c  System memory - ok
18:39:11.0908 0x587c  ================ Scan services =============================
18:39:11.0941 0x587c  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
18:39:11.0998 0x587c  1394ohci - ok
18:39:12.0014 0x587c  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
18:39:12.0038 0x587c  ACPI - ok
18:39:12.0041 0x587c  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
18:39:12.0059 0x587c  AcpiPmi - ok
18:39:12.0076 0x587c  [ 9511C276FECBE39FD1E08DC6BA1CF6E9, 0544D666D002BD2BBEAA0F073CD310DDF38EF44B9294D46E9E2F5E237B1787F1 ] AdAppMgrSvc     C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
18:39:12.0108 0x587c  AdAppMgrSvc - ok
18:39:12.0123 0x587c  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
18:39:12.0152 0x587c  adp94xx - ok
18:39:12.0163 0x587c  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
18:39:12.0185 0x587c  adpahci - ok
18:39:12.0192 0x587c  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
18:39:12.0212 0x587c  adpu320 - ok
18:39:12.0218 0x587c  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
18:39:12.0250 0x587c  AeLookupSvc - ok
18:39:12.0264 0x587c  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
18:39:12.0298 0x587c  AFD - ok
18:39:12.0303 0x587c  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
18:39:12.0317 0x587c  agp440 - ok
18:39:12.0321 0x587c  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
18:39:12.0340 0x587c  ALG - ok
18:39:12.0343 0x587c  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
18:39:12.0356 0x587c  aliide - ok
18:39:12.0365 0x587c  [ F17B1902DFCED1C24DB57492A7896FF8, 966AB1A072A8AF98D7EDD2A388D919B50FC41A06E1C51B04B2C2F54F1BA7F0D5 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
18:39:12.0392 0x587c  AMD External Events Utility - ok
18:39:12.0395 0x587c  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
18:39:12.0408 0x587c  amdide - ok
18:39:12.0412 0x587c  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
18:39:12.0430 0x587c  AmdK8 - ok
18:39:12.0732 0x587c  [ 81FCDBBA547919D59DC134ED717658B4, 9A95C4400CAE00F25EE10BAE8949CF7317954742EB6F0831AAAEA4A2C220E56B ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
18:39:13.0188 0x587c  amdkmdag - ok
18:39:13.0215 0x587c  [ AF6B384E03D15471EDCEDDDEBAA363B2, 2D8CFA26D69A8FF0FAC6EBA2E5A62977B21ECBA0C65458072FEC4A886B3EDD73 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
18:39:13.0253 0x587c  amdkmdap - ok
18:39:13.0258 0x587c  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
18:39:13.0278 0x587c  AmdPPM - ok
18:39:13.0282 0x587c  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
18:39:13.0298 0x587c  amdsata - ok
18:39:13.0306 0x587c  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
18:39:13.0327 0x587c  amdsbs - ok
18:39:13.0330 0x587c  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
18:39:13.0344 0x587c  amdxata - ok
18:39:13.0348 0x587c  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
18:39:13.0382 0x587c  AppID - ok
18:39:13.0386 0x587c  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
18:39:13.0416 0x587c  AppIDSvc - ok
18:39:13.0420 0x587c  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
18:39:13.0438 0x587c  Appinfo - ok
18:39:13.0447 0x587c  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
18:39:13.0469 0x587c  AppMgmt - ok
18:39:13.0473 0x587c  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
18:39:13.0489 0x587c  arc - ok
18:39:13.0494 0x587c  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
18:39:13.0509 0x587c  arcsas - ok
18:39:13.0522 0x587c  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
18:39:13.0538 0x587c  aspnet_state - ok
18:39:13.0542 0x587c  [ 001CFE1AE7A6377D70F654305ED10458, 02319F42082DD01715521BB01C63D93A783890F5EEF4F97E34401D6BF2537075 ] aswHwid         C:\Windows\system32\drivers\aswHwid.sys
18:39:13.0562 0x587c  aswHwid - ok
18:39:13.0566 0x587c  [ CDE120D6279DD61B341CB871C48E5374, D9A5845F405D14268D5DCD54F88DB87FC4071042D65ED08F0F1687740F3E2657 ] aswMonFlt       C:\Windows\system32\drivers\aswMonFlt.sys
18:39:13.0581 0x587c  aswMonFlt - ok
18:39:13.0586 0x587c  [ 6669541A3566F5B2F64A87ACC9B8821F, DD99968B1D78B55A6A19C8D494B7FB39ADF5175BD223B01E4C833AE10BBD019A ] aswRdr          C:\Windows\system32\drivers\aswRdr2.sys
18:39:13.0602 0x587c  aswRdr - ok
18:39:13.0605 0x587c  [ 60FED5EA7F14315C319E7FFB3679CC24, 19774A9C0DB86ED99434A194C9138682982EEFEA43CE33AB38985445C72B4C03 ] aswRvrt         C:\Windows\system32\drivers\aswRvrt.sys
18:39:13.0619 0x587c  aswRvrt - ok
18:39:13.0641 0x587c  [ 56098BE0C735ED563C466CD835937993, D160FF497CF24B8302D4DDE8C91C9D298B4173B7250015D7E765D7E3FCB4E538 ] aswSnx          C:\Windows\system32\drivers\aswSnx.sys
18:39:13.0685 0x587c  aswSnx - ok
18:39:13.0698 0x587c  [ 6FC940A01C53BC874F531349E991F2BC, C7D84127217D556D7722B0EBC38057C8DFA173265A6E1DBF89CA47379F061ED7 ] aswSP           C:\Windows\system32\drivers\aswSP.sys
18:39:13.0723 0x587c  aswSP - ok
18:39:13.0728 0x587c  [ 7250DFE069F4CB68F736A12F51AC083E, 7422A030786F777E914E1D6C10BC9B94B03B4AA2A8F888FE948004B91C60CD07 ] aswStm          C:\Windows\system32\drivers\aswStm.sys
18:39:13.0744 0x587c  aswStm - ok
18:39:13.0752 0x587c  [ 5EA98C99B780EE215401658BE5E217CA, A778F2E2414BD0C9C572BEAC1DD0A805ED1827A25D6208D650AEBCCEED4D6994 ] aswVmm          C:\Windows\system32\drivers\aswVmm.sys
18:39:13.0770 0x587c  aswVmm - ok
18:39:13.0775 0x587c  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
18:39:13.0804 0x587c  AsyncMac - ok
18:39:13.0808 0x587c  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
18:39:13.0822 0x587c  atapi - ok
18:39:13.0827 0x587c  [ AAAE03F8EDA817EC28C5445193EA8BF3, 5A2ECB66936B87651202CAA7786D58DE6BFD8217B059C88775EB4B07BA2ADB89 ] AthBTPort       C:\Windows\system32\DRIVERS\btath_flt.sys
18:39:13.0840 0x587c  AthBTPort - ok
18:39:13.0843 0x587c  [ 4ECC791539F23982411864037D1AC8FC, 063CBA00E453B5FF3CDFDFB5FA2E6A190A0DC3D399EC36F646262BE76F98A60C ] ATHDFU          C:\Windows\system32\Drivers\AthDfu.sys
18:39:13.0856 0x587c  ATHDFU - ok
18:39:13.0861 0x587c  [ C34B28D6285EAD94B3A2FABA84E90DA5, 82E69CBDEB9B0D6A2056AE6227A21C4CDB3050B384D69FA879607F3363ABBFD1 ] AtherosSvc      C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
18:39:13.0873 0x587c  AtherosSvc - detected UnsignedFile.Multi.Generic ( 1 )
18:39:17.0576 0x587c  Detect skipped due to KSN trusted
18:39:17.0576 0x587c  AtherosSvc - ok
18:39:17.0587 0x587c  [ 33497249626E7787AA5CEA99B226CCA6, EF6213B79F83334CD95E4A58A4FE64190AA3FEFF590E41C4BF302FC4A8F6D6D6 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
18:39:17.0619 0x587c  AtiHDAudioService - ok
18:39:17.0640 0x587c  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:39:17.0692 0x587c  AudioEndpointBuilder - ok
18:39:17.0710 0x587c  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
18:39:17.0755 0x587c  AudioSrv - ok
18:39:17.0763 0x587c  [ 5CE4F1E7D1BF789919DC7F2E7603C638, 604D4D824B9FE183B82637D212D7804DC88D6475383C1E6EE4269CAAD82E7C13 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
18:39:17.0777 0x587c  avast! Antivirus - ok
18:39:17.0781 0x587c  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
18:39:17.0804 0x587c  AxInstSV - ok
18:39:17.0818 0x587c  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
18:39:17.0852 0x587c  b06bdrv - ok
18:39:17.0861 0x587c  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
18:39:17.0886 0x587c  b57nd60a - ok
18:39:17.0894 0x587c  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
18:39:17.0915 0x587c  BDESVC - ok
18:39:17.0918 0x587c  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
18:39:17.0947 0x587c  Beep - ok
18:39:17.0966 0x587c  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
18:39:18.0003 0x587c  BFE - ok
18:39:18.0026 0x587c  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
18:39:18.0084 0x587c  BITS - ok
18:39:18.0088 0x587c  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
18:39:18.0105 0x587c  blbdrive - ok
18:39:18.0111 0x587c  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
18:39:18.0129 0x587c  bowser - ok
18:39:18.0132 0x587c  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
18:39:18.0149 0x587c  BrFiltLo - ok
18:39:18.0152 0x587c  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
18:39:18.0170 0x587c  BrFiltUp - ok
18:39:18.0175 0x587c  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
18:39:18.0193 0x587c  Browser - ok
18:39:18.0202 0x587c  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
18:39:18.0232 0x587c  Brserid - ok
18:39:18.0236 0x587c  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
18:39:18.0255 0x587c  BrSerWdm - ok
18:39:18.0257 0x587c  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
18:39:18.0276 0x587c  BrUsbMdm - ok
18:39:18.0279 0x587c  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
18:39:18.0295 0x587c  BrUsbSer - ok
18:39:18.0307 0x587c  [ 3B1B573371B206D1D5F25E0EF5FCD6D6, 9CE8E687F7554FF4AD989015806D3A03A801647C88ECADF08F7404E49517680C ] BTATH_A2DP      C:\Windows\system32\drivers\btath_a2dp.sys
18:39:18.0331 0x587c  BTATH_A2DP - ok
18:39:18.0335 0x587c  [ 2D0446336D9DB55A742B999EC16ADF15, FBF57CBDCFE4146176ABBD7ACF04240048403143DD380E10AE63B10BA5D4F311 ] BTATH_BUS       C:\Windows\system32\DRIVERS\btath_bus.sys
18:39:18.0347 0x587c  BTATH_BUS - ok
18:39:18.0354 0x587c  [ 9A9694BBEB2849EAF95DFFCAE5DF02AD, 6534E599DDDF04A42E25581BB1CF4507B5F2E332FC74961C7F2CB8F672683C39 ] BTATH_HCRP      C:\Windows\system32\DRIVERS\btath_hcrp.sys
18:39:18.0371 0x587c  BTATH_HCRP - ok
18:39:18.0375 0x587c  [ FC0A8075DDF2E9C66267AEC91E0676F9, BAEBBA87DE72E996C9466FF15D9FD01DBD5D1A1097FC0FFB4819550830DEBCBC ] BTATH_LWFLT     C:\Windows\system32\DRIVERS\btath_lwflt.sys
18:39:18.0389 0x587c  BTATH_LWFLT - ok
18:39:18.0396 0x587c  [ 5EB4815CBDDBA4541F2380DAE6E269AB, DBBB0B1E5946BE5CA0C28F4175DE10613A3E5A89DCE0D6B9EDDF756B08CD274B ] BTATH_RCP       C:\Windows\system32\DRIVERS\btath_rcp.sys
18:39:18.0411 0x587c  BTATH_RCP - ok
18:39:18.0422 0x587c  [ 0ECEDE7B33CFD9A52A61220ABBD09A50, 4E52C0A1626D26E882B0273204B1415D779E188F7AF7ABCEBF72EC6DAF9810F5 ] BtFilter        C:\Windows\system32\DRIVERS\btfilter.sys
18:39:18.0443 0x587c  BtFilter - ok
18:39:18.0447 0x587c  [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys
18:39:18.0463 0x587c  BthEnum - ok
18:39:18.0468 0x587c  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
18:39:18.0488 0x587c  BTHMODEM - ok
18:39:18.0493 0x587c  [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
18:39:18.0556 0x587c  BthPan - ok
18:39:18.0570 0x587c  [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys
18:39:18.0619 0x587c  BTHPORT - ok
18:39:18.0624 0x587c  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
18:39:18.0656 0x587c  bthserv - ok
18:39:18.0660 0x587c  [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
18:39:18.0730 0x587c  BTHUSB - ok
18:39:18.0734 0x587c  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
18:39:18.0770 0x587c  cdfs - ok
18:39:18.0776 0x587c  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\drivers\cdrom.sys
18:39:18.0795 0x587c  cdrom - ok
18:39:18.0801 0x587c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
18:39:18.0835 0x587c  CertPropSvc - ok
18:39:18.0838 0x587c  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
18:39:18.0859 0x587c  circlass - ok
18:39:18.0872 0x587c  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
18:39:18.0896 0x587c  CLFS - ok
18:39:18.0903 0x587c  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:39:18.0920 0x587c  clr_optimization_v2.0.50727_32 - ok
18:39:18.0930 0x587c  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
18:39:18.0947 0x587c  clr_optimization_v2.0.50727_64 - ok
18:39:18.0960 0x587c  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:39:18.0978 0x587c  clr_optimization_v4.0.30319_32 - ok
18:39:18.0983 0x587c  [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
18:39:19.0001 0x587c  clr_optimization_v4.0.30319_64 - ok
18:39:19.0005 0x587c  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
18:39:19.0020 0x587c  CmBatt - ok
18:39:19.0023 0x587c  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
18:39:19.0036 0x587c  cmdide - ok
18:39:19.0048 0x587c  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys
18:39:19.0077 0x587c  CNG - ok
18:39:19.0081 0x587c  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
18:39:19.0095 0x587c  Compbatt - ok
18:39:19.0098 0x587c  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
18:39:19.0115 0x587c  CompositeBus - ok
18:39:19.0118 0x587c  COMSysApp - ok
18:39:19.0121 0x587c  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
18:39:19.0135 0x587c  crcdisk - ok
18:39:19.0143 0x587c  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll
18:39:19.0166 0x587c  CryptSvc - ok
18:39:19.0180 0x587c  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
18:39:19.0213 0x587c  CSC - ok
18:39:19.0231 0x587c  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
18:39:19.0270 0x587c  CscService - ok
18:39:19.0285 0x587c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
18:39:19.0331 0x587c  DcomLaunch - ok
18:39:19.0340 0x587c  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
18:39:19.0380 0x587c  defragsvc - ok
18:39:19.0385 0x587c  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
18:39:19.0417 0x587c  DfsC - ok
18:39:19.0426 0x587c  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
18:39:19.0453 0x587c  Dhcp - ok
18:39:19.0457 0x587c  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
18:39:19.0487 0x587c  discache - ok
18:39:19.0491 0x587c  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
18:39:19.0507 0x587c  Disk - ok
18:39:19.0512 0x587c  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
18:39:19.0531 0x587c  Dnscache - ok
18:39:19.0541 0x587c  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
18:39:19.0578 0x587c  dot3svc - ok
18:39:19.0584 0x587c  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
18:39:19.0618 0x587c  DPS - ok
18:39:19.0621 0x587c  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
18:39:19.0636 0x587c  drmkaud - ok
18:39:19.0655 0x587c  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
18:39:19.0694 0x587c  DXGKrnl - ok
18:39:19.0700 0x587c  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
18:39:19.0734 0x587c  EapHost - ok
18:39:19.0811 0x587c  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
18:39:19.0921 0x587c  ebdrv - ok
18:39:19.0927 0x587c  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS             C:\Windows\System32\lsass.exe
18:39:19.0943 0x587c  EFS - ok
18:39:19.0962 0x587c  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
18:39:20.0007 0x587c  ehRecvr - ok
18:39:20.0012 0x587c  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
18:39:20.0032 0x587c  ehSched - ok
18:39:20.0045 0x587c  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
18:39:20.0072 0x587c  elxstor - ok
18:39:20.0075 0x587c  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
18:39:20.0089 0x587c  ErrDev - ok
18:39:20.0104 0x587c  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
18:39:20.0148 0x587c  EventSystem - ok
18:39:20.0156 0x587c  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
18:39:20.0190 0x587c  exfat - ok
18:39:20.0196 0x587c  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
18:39:20.0230 0x587c  fastfat - ok
18:39:20.0246 0x587c  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
18:39:20.0283 0x587c  Fax - ok
18:39:20.0287 0x587c  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
18:39:20.0303 0x587c  fdc - ok
18:39:20.0306 0x587c  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
18:39:20.0336 0x587c  fdPHost - ok
18:39:20.0339 0x587c  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
18:39:20.0369 0x587c  FDResPub - ok
18:39:20.0373 0x587c  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
18:39:20.0388 0x587c  FileInfo - ok
18:39:20.0391 0x587c  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
18:39:20.0420 0x587c  Filetrace - ok
18:39:20.0459 0x587c  [ 8645F91F40B8D022C9AC3DABDF360A6B, 4F83080B1273C92470EB90D80B32056C913240DCC9C4C50B7BE85254066D654D ] FlexNet Licensing Service 64 C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe
18:39:20.0502 0x587c  FlexNet Licensing Service 64 - ok
18:39:20.0506 0x587c  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
18:39:20.0521 0x587c  flpydisk - ok
18:39:20.0530 0x587c  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
18:39:20.0551 0x587c  FltMgr - ok
18:39:20.0580 0x587c  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
18:39:20.0639 0x587c  FontCache - ok
18:39:20.0643 0x587c  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
18:39:20.0658 0x587c  FontCache3.0.0.0 - ok
18:39:20.0661 0x587c  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
18:39:20.0676 0x587c  FsDepends - ok
18:39:20.0678 0x587c  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
18:39:20.0691 0x587c  Fs_Rec - ok
18:39:20.0698 0x587c  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
18:39:20.0719 0x587c  fvevol - ok
18:39:20.0723 0x587c  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
18:39:20.0738 0x587c  gagp30kx - ok
18:39:20.0757 0x587c  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
18:39:20.0815 0x587c  gpsvc - ok
18:39:20.0819 0x587c  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
18:39:20.0835 0x587c  hcw85cir - ok
18:39:20.0845 0x587c  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:39:20.0874 0x587c  HdAudAddService - ok
18:39:20.0879 0x587c  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
18:39:20.0900 0x587c  HDAudBus - ok
18:39:20.0904 0x587c  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
18:39:20.0922 0x587c  HidBatt - ok
18:39:20.0927 0x587c  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
18:39:20.0948 0x587c  HidBth - ok
18:39:20.0951 0x587c  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
18:39:20.0970 0x587c  HidIr - ok
18:39:20.0973 0x587c  [ D42E350C3F5B9DDCE7BDDB109B413109, F015CCAB3719B1834DF3EE0265D905675C743F116526A2882B6077E540B8A74F ] hidkmdf         C:\Windows\system32\DRIVERS\hidkmdf.sys
18:39:20.0985 0x587c  hidkmdf - ok
18:39:20.0987 0x587c  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
18:39:21.0018 0x587c  hidserv - ok
18:39:21.0022 0x587c  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
18:39:21.0037 0x587c  HidUsb - ok
18:39:21.0041 0x587c  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
18:39:21.0074 0x587c  hkmsvc - ok
18:39:21.0082 0x587c  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
18:39:21.0107 0x587c  HomeGroupListener - ok
18:39:21.0114 0x587c  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
18:39:21.0136 0x587c  HomeGroupProvider - ok
18:39:21.0141 0x587c  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
18:39:21.0156 0x587c  HpSAMD - ok
18:39:21.0174 0x587c  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
18:39:21.0228 0x587c  HTTP - ok
18:39:21.0231 0x587c  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
18:39:21.0243 0x587c  hwpolicy - ok
18:39:21.0248 0x587c  [ 4B7423FCC37664954460AC3E71752B62, D334D1C72691C1BF24A4D8133F61AD51B058A080F4501F05F12C673DCFE081F9 ] hxctlflt        C:\Windows\system32\DRIVERS\hxctlflt.sys
18:39:21.0265 0x587c  hxctlflt - ok
18:39:21.0270 0x587c  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
18:39:21.0287 0x587c  i8042prt - ok
18:39:21.0298 0x587c  [ D7921D5A870B11CC1ADAB198A519D50A, 5DF99EB5D5504E9D9EB21658E8B4A58DEE2AD143A1875DB7F9B7BF4877FCB57F ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
18:39:21.0321 0x587c  iaStor - ok
18:39:21.0325 0x587c  [ 8FFF9083252C16FE3960173722605E9E, 6546FDA34B9AF94C5E86E5269BBC2F02F1E78D6D4BE5B5EC01F4B284CC934994 ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
18:39:21.0338 0x587c  IAStorDataMgrSvc - ok
18:39:21.0349 0x587c  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
18:39:21.0374 0x587c  iaStorV - ok
18:39:21.0397 0x587c  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
18:39:21.0439 0x587c  idsvc - ok
18:39:21.0442 0x587c  IEEtwCollectorService - ok
18:39:21.0445 0x587c  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
18:39:21.0459 0x587c  iirsp - ok
18:39:21.0479 0x587c  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
18:39:21.0521 0x587c  IKEEXT - ok
18:39:21.0580 0x587c  [ DAB7318CCFA8081200D5B7B486793F74, 1D0833352D125D7C46F51401C8DE66DB92E3104003917BAEFE4A21218531C330 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
18:39:21.0664 0x587c  IntcAzAudAddService - ok
18:39:21.0670 0x587c  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
18:39:21.0683 0x587c  intelide - ok
18:39:21.0687 0x587c  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
18:39:21.0704 0x587c  intelppm - ok
18:39:21.0709 0x587c  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
18:39:21.0743 0x587c  IPBusEnum - ok
18:39:21.0749 0x587c  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:39:21.0782 0x587c  IpFilterDriver - ok
18:39:21.0796 0x587c  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
18:39:21.0832 0x587c  iphlpsvc - ok
18:39:21.0837 0x587c  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
18:39:21.0854 0x587c  IPMIDRV - ok
18:39:21.0861 0x587c  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
18:39:21.0896 0x587c  IPNAT - ok
18:39:21.0900 0x587c  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
18:39:21.0918 0x587c  IRENUM - ok
18:39:21.0921 0x587c  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
18:39:21.0934 0x587c  isapnp - ok
18:39:21.0944 0x587c  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
18:39:21.0965 0x587c  iScsiPrt - ok
18:39:21.0969 0x587c  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
18:39:21.0983 0x587c  kbdclass - ok
18:39:21.0988 0x587c  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
18:39:22.0003 0x587c  kbdhid - ok
18:39:22.0007 0x587c  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso          C:\Windows\system32\lsass.exe
18:39:22.0021 0x587c  KeyIso - ok
18:39:22.0026 0x587c  [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
18:39:22.0041 0x587c  KSecDD - ok
18:39:22.0046 0x587c  [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
18:39:22.0063 0x587c  KSecPkg - ok
18:39:22.0066 0x587c  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
18:39:22.0095 0x587c  ksthunk - ok
18:39:22.0105 0x587c  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
18:39:22.0150 0x587c  KtmRm - ok
18:39:22.0158 0x587c  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
18:39:22.0195 0x587c  LanmanServer - ok
18:39:22.0201 0x587c  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:39:22.0235 0x587c  LanmanWorkstation - ok
18:39:22.0239 0x587c  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
18:39:22.0271 0x587c  lltdio - ok
18:39:22.0282 0x587c  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
18:39:22.0323 0x587c  lltdsvc - ok
18:39:22.0328 0x587c  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
18:39:22.0359 0x587c  lmhosts - ok
18:39:22.0365 0x587c  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
18:39:22.0381 0x587c  LSI_FC - ok
18:39:22.0387 0x587c  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
18:39:22.0403 0x587c  LSI_SAS - ok
18:39:22.0408 0x587c  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
18:39:22.0424 0x587c  LSI_SAS2 - ok
18:39:22.0429 0x587c  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
18:39:22.0446 0x587c  LSI_SCSI - ok
18:39:22.0451 0x587c  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
18:39:22.0484 0x587c  luafv - ok
18:39:22.0488 0x587c  [ 6AA6B239CFCD14870EB186FE0651A434, 8D3378CCE6E020B9F464E2160F0F1A7F16AAEBC7825370BE7A02FFAB4883DBEA ] ManyCam         C:\Windows\system32\DRIVERS\mcvidrv.sys
18:39:22.0501 0x587c  ManyCam - ok
18:39:22.0505 0x587c  [ 5C3669B71657F22E67A1D4BD49D2CBE7, 7CAE59AA6CA9CBBD70BBD707A155FB169BF3F71096275BF7C0F415B6A092C671 ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys
18:39:22.0518 0x587c  MBAMProtector - ok
18:39:22.0550 0x587c  [ 6D8A2EE4244630B290A837E79C0F37A1, 6783BBC0BDC93E4D6D43531A1AD0DF5CD26C3BBFA6384927C5CF65AD97FB04AD ] MBAMScheduler   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
18:39:22.0614 0x587c  MBAMScheduler - ok
18:39:22.0633 0x587c  [ 09D4503CBB6ADB3A54E7C7A75090B728, 6139EA3338FD64205481EDEC813A44F8D395FDA7B67AA431DA61F3631C3EDAE6 ] MBAMService     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
18:39:22.0671 0x587c  MBAMService - ok
18:39:22.0677 0x587c  [ 26C43960C99EE861A5D0EDC4DCF3B1C3, 6238FB8E785652040CCE3E7044EA52066CE1BF173A1467474D64A3AB214B6BCD ] MBAMSwissArmy   C:\Windows\system32\drivers\MBAMSwissArmy.sys
18:39:22.0695 0x587c  MBAMSwissArmy - ok
18:39:22.0699 0x587c  [ 95EF63A7827D4E3A229CBBCB42619E93, FA38DD035B2C4FC82B60868F49D45A39FBBC96096AAD5A2C8BD752A250255BA7 ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
18:39:22.0712 0x587c  MBAMWebAccessControl - ok
18:39:22.0715 0x587c  [ 4C017AF4CBC57A36C75A270184CC86CB, F6FC22955BD047145B3E43400576530FE351AD68AA2A2EA4F80FF463435F5360 ] mcaudrv_simple  C:\Windows\system32\drivers\mcaudrv_x64.sys
18:39:22.0727 0x587c  mcaudrv_simple - ok
18:39:22.0732 0x587c  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
18:39:22.0752 0x587c  Mcx2Svc - ok
18:39:22.0754 0x587c  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
18:39:22.0768 0x587c  megasas - ok
18:39:22.0776 0x587c  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
18:39:22.0799 0x587c  MegaSR - ok
18:39:22.0804 0x587c  [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
18:39:22.0817 0x587c  MEIx64 - ok
18:39:22.0829 0x587c  [ 0AF89452A8CE3928168F4E5B2208C68B, 571F1A9F1F0B31DB5FFAE7FB7F98C16958439D6666A9F2131B0F2E496BF3D2AC ] mi-raysat_3dsmax2015_64 C:\Program Files\Autodesk\3ds Max 2015\NVIDIA\Satellite\raysat_3dsmax2015_64server.exe
18:39:22.0844 0x587c  mi-raysat_3dsmax2015_64 - detected UnsignedFile.Multi.Generic ( 1 )
18:39:25.0812 0x587c  Detect skipped due to KSN trusted
18:39:25.0812 0x587c  mi-raysat_3dsmax2015_64 - ok
18:39:25.0819 0x587c  [ FAFE367D032ED82E9332B4C741A20216, 7B123766E360570E0FCB211835B7910D6A1806C25A06BCA9227AB9E993376CA8 ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
18:39:25.0835 0x587c  Microsoft Office Groove Audit Service - ok
18:39:25.0840 0x587c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
18:39:25.0875 0x587c  MMCSS - ok
18:39:25.0879 0x587c  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
18:39:25.0909 0x587c  Modem - ok
18:39:25.0914 0x587c  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
18:39:25.0931 0x587c  monitor - ok
18:39:25.0935 0x587c  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
18:39:25.0949 0x587c  mouclass - ok
18:39:25.0952 0x587c  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
18:39:25.0967 0x587c  mouhid - ok
18:39:25.0972 0x587c  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
18:39:25.0987 0x587c  mountmgr - ok
18:39:25.0991 0x587c  [ 28048289E32294004A86935CC40A3252, D397C3BAD6BCDA33FA0982E10677598E8BDF69A0933D19A36873CB45BA4FB819 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
18:39:26.0006 0x587c  MozillaMaintenance - ok
18:39:26.0012 0x587c  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
18:39:26.0030 0x587c  mpio - ok
18:39:26.0034 0x587c  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
18:39:26.0067 0x587c  mpsdrv - ok
18:39:26.0086 0x587c  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
18:39:26.0142 0x587c  MpsSvc - ok
18:39:26.0149 0x587c  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
18:39:26.0172 0x587c  MRxDAV - ok
18:39:26.0180 0x587c  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
18:39:26.0200 0x587c  mrxsmb - ok
18:39:26.0209 0x587c  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:39:26.0233 0x587c  mrxsmb10 - ok
18:39:26.0238 0x587c  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:39:26.0257 0x587c  mrxsmb20 - ok
18:39:26.0260 0x587c  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
18:39:26.0274 0x587c  msahci - ok
18:39:26.0279 0x587c  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
18:39:26.0295 0x587c  msdsm - ok
18:39:26.0301 0x587c  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
18:39:26.0323 0x587c  MSDTC - ok
18:39:26.0328 0x587c  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
18:39:26.0357 0x587c  Msfs - ok
18:39:26.0360 0x587c  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
18:39:26.0390 0x587c  mshidkmdf - ok
18:39:26.0392 0x587c  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
18:39:26.0405 0x587c  msisadrv - ok
18:39:26.0413 0x587c  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
18:39:26.0451 0x587c  MSiSCSI - ok
18:39:26.0453 0x587c  msiserver - ok
18:39:26.0456 0x587c  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
18:39:26.0485 0x587c  MSKSSRV - ok
18:39:26.0488 0x587c  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
18:39:26.0517 0x587c  MSPCLOCK - ok
18:39:26.0521 0x587c  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
18:39:26.0550 0x587c  MSPQM - ok
18:39:26.0560 0x587c  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
18:39:26.0581 0x587c  MsRPC - ok
18:39:26.0586 0x587c  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
18:39:26.0599 0x587c  mssmbios - ok
18:39:26.0602 0x587c  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
18:39:26.0633 0x587c  MSTEE - ok
18:39:26.0635 0x587c  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
18:39:26.0650 0x587c  MTConfig - ok
18:39:26.0654 0x587c  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
18:39:26.0669 0x587c  Mup - ok
18:39:26.0678 0x587c  [ 38B4C95E821528FB91DF16A78E04450F, 8ADDF63088293923B497E1AFF86C189669B973F43153FEE2370EA32860D71AD7 ] mv91xx          C:\Windows\system32\DRIVERS\mv91xx.sys
18:39:26.0704 0x587c  mv91xx - ok
18:39:26.0717 0x587c  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
18:39:26.0764 0x587c  napagent - ok
18:39:26.0775 0x587c  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
18:39:26.0804 0x587c  NativeWifiP - ok
18:39:26.0826 0x587c  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
18:39:26.0867 0x587c  NDIS - ok
18:39:26.0871 0x587c  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
18:39:26.0902 0x587c  NdisCap - ok
18:39:26.0905 0x587c  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
18:39:26.0934 0x587c  NdisTapi - ok
18:39:26.0938 0x587c  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
18:39:26.0970 0x587c  Ndisuio - ok
18:39:26.0978 0x587c  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
18:39:27.0011 0x587c  NdisWan - ok
18:39:27.0015 0x587c  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
18:39:27.0044 0x587c  NDProxy - ok
18:39:27.0048 0x587c  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
18:39:27.0078 0x587c  NetBIOS - ok
18:39:27.0085 0x587c  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
18:39:27.0120 0x587c  NetBT - ok
18:39:27.0123 0x587c  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon        C:\Windows\system32\lsass.exe
18:39:27.0138 0x587c  Netlogon - ok
18:39:27.0151 0x587c  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
18:39:27.0194 0x587c  Netman - ok
18:39:27.0201 0x587c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:39:27.0221 0x587c  NetMsmqActivator - ok
18:39:27.0228 0x587c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:39:27.0245 0x587c  NetPipeActivator - ok
18:39:27.0257 0x587c  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
18:39:27.0299 0x587c  netprofm - ok
18:39:27.0306 0x587c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:39:27.0323 0x587c  NetTcpActivator - ok
18:39:27.0329 0x587c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:39:27.0345 0x587c  NetTcpPortSharing - ok
18:39:27.0350 0x587c  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
18:39:27.0365 0x587c  nfrd960 - ok
18:39:27.0373 0x587c  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\Windows\System32\nlasvc.dll
18:39:27.0399 0x587c  NlaSvc - ok
18:39:27.0402 0x587c  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
18:39:27.0433 0x587c  Npfs - ok
18:39:27.0436 0x587c  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
18:39:27.0467 0x587c  nsi - ok
18:39:27.0470 0x587c  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
18:39:27.0500 0x587c  nsiproxy - ok
18:39:27.0537 0x587c  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
18:39:27.0593 0x587c  Ntfs - ok
18:39:27.0597 0x587c  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
18:39:27.0626 0x587c  Null - ok
18:39:27.0631 0x587c  [ 158AD24745BD85BA9BE3C51C38F48C32, B053A3B5A5CAE2CBC47E2C19E636AD70F376334EFFBB391A76562E67CBF3AC86 ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys
18:39:27.0648 0x587c  nusb3hub - ok
18:39:27.0654 0x587c  [ D40A13B2C0891E218F9523B376955DB6, 9A2AAAF960868B860A65579EAD507B35C64CFD6C3581F8D731ADF975F778D10E ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys
18:39:27.0675 0x587c  nusb3xhc - ok
18:39:27.0681 0x587c  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
18:39:27.0698 0x587c  nvraid - ok
18:39:27.0704 0x587c  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
18:39:27.0721 0x587c  nvstor - ok
18:39:27.0727 0x587c  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
18:39:27.0743 0x587c  nv_agp - ok
18:39:27.0754 0x587c  [ 84DE1DD996B48B05ACE31AD015FA108A, 4B9D1E4EF83ECED6C77F23D9879C124534F7053D7423E3A2D0F67A4A720CEA94 ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
18:39:27.0777 0x587c  odserv - ok
18:39:27.0782 0x587c  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
18:39:27.0799 0x587c  ohci1394 - ok
18:39:27.0805 0x587c  [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:39:27.0822 0x587c  ose - ok
18:39:27.0834 0x587c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
18:39:27.0862 0x587c  p2pimsvc - ok
18:39:27.0876 0x587c  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
18:39:27.0907 0x587c  p2psvc - ok
18:39:27.0921 0x587c  [ B87EFC9994F53124622FA2A0CAA6D828, A0F761A6BE9B44CE0E87B270DC2745C092226B1431B6C360FCFF9D299E0E6B63 ] PAC7302         C:\Windows\system32\DRIVERS\PAC7302.SYS
18:39:27.0952 0x587c  PAC7302 - ok
18:39:27.0957 0x587c  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
18:39:27.0977 0x587c  Parport - ok
18:39:27.0981 0x587c  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
18:39:27.0996 0x587c  partmgr - ok
18:39:28.0004 0x587c  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
18:39:28.0029 0x587c  PcaSvc - ok
18:39:28.0035 0x587c  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
18:39:28.0054 0x587c  pci - ok
18:39:28.0057 0x587c  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
18:39:28.0070 0x587c  pciide - ok
18:39:28.0078 0x587c  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
18:39:28.0100 0x587c  pcmcia - ok
18:39:28.0104 0x587c  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
18:39:28.0119 0x587c  pcw - ok
18:39:28.0134 0x587c  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
18:39:28.0187 0x587c  PEAUTH - ok
18:39:28.0220 0x587c  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
18:39:28.0280 0x587c  PeerDistSvc - ok
18:39:28.0301 0x587c  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
18:39:28.0319 0x587c  PerfHost - ok
18:39:28.0351 0x587c  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
18:39:28.0426 0x587c  pla - ok
18:39:28.0439 0x587c  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
18:39:28.0470 0x587c  PlugPlay - ok
18:39:28.0474 0x587c  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
18:39:28.0491 0x587c  PNRPAutoReg - ok
18:39:28.0502 0x587c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
18:39:28.0525 0x587c  PNRPsvc - ok
18:39:28.0537 0x587c  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
18:39:28.0582 0x587c  PolicyAgent - ok
18:39:28.0589 0x587c  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
18:39:28.0625 0x587c  Power - ok
18:39:28.0630 0x587c  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
18:39:28.0663 0x587c  PptpMiniport - ok
18:39:28.0667 0x587c  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
18:39:28.0685 0x587c  Processor - ok
18:39:28.0691 0x587c  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\Windows\system32\profsvc.dll
18:39:28.0714 0x587c  ProfSvc - ok
18:39:28.0718 0x587c  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
18:39:28.0733 0x587c  ProtectedStorage - ok
18:39:28.0738 0x587c  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
18:39:28.0771 0x587c  Psched - ok
18:39:28.0775 0x587c  [ BC08F7F3C53CBEE68670ED1314E290FD, EC683DDE60AFED297D28BC7570BB6DA27A94F52417AD6DE1FBE265255F4051DD ] PxHlpa64        C:\Windows\system32\Drivers\PxHlpa64.sys
18:39:28.0789 0x587c  PxHlpa64 - ok
18:39:28.0828 0x587c  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
18:39:28.0891 0x587c  ql2300 - ok
18:39:28.0896 0x587c  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
18:39:28.0912 0x587c  ql40xx - ok
18:39:28.0922 0x587c  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
18:39:28.0950 0x587c  QWAVE - ok
18:39:28.0953 0x587c  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
18:39:28.0973 0x587c  QWAVEdrv - ok
18:39:28.0976 0x587c  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
18:39:29.0006 0x587c  RasAcd - ok
18:39:29.0010 0x587c  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
18:39:29.0040 0x587c  RasAgileVpn - ok
18:39:29.0044 0x587c  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
18:39:29.0078 0x587c  RasAuto - ok
18:39:29.0083 0x587c  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
18:39:29.0116 0x587c  Rasl2tp - ok
18:39:29.0126 0x587c  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
18:39:29.0168 0x587c  RasMan - ok
18:39:29.0174 0x587c  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
18:39:29.0206 0x587c  RasPppoe - ok
18:39:29.0210 0x587c  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
18:39:29.0243 0x587c  RasSstp - ok
18:39:29.0253 0x587c  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
18:39:29.0291 0x587c  rdbss - ok
18:39:29.0294 0x587c  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
18:39:29.0311 0x587c  rdpbus - ok
18:39:29.0314 0x587c  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
18:39:29.0342 0x587c  RDPCDD - ok
18:39:29.0351 0x587c  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
18:39:29.0371 0x587c  RDPDR - ok
18:39:29.0375 0x587c  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
18:39:29.0404 0x587c  RDPENCDD - ok
18:39:29.0409 0x587c  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
18:39:29.0438 0x587c  RDPREFMP - ok
18:39:29.0442 0x587c  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
18:39:29.0458 0x587c  RdpVideoMiniport - ok
18:39:29.0468 0x587c  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
18:39:29.0488 0x587c  RDPWD - ok
18:39:29.0496 0x587c  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
18:39:29.0515 0x587c  rdyboost - ok
18:39:29.0520 0x587c  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
18:39:29.0554 0x587c  RemoteAccess - ok
18:39:29.0561 0x587c  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
18:39:29.0597 0x587c  RemoteRegistry - ok
18:39:29.0603 0x587c  [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
18:39:29.0625 0x587c  RFCOMM - ok
18:39:29.0629 0x587c  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
18:39:29.0662 0x587c  RpcEptMapper - ok
18:39:29.0664 0x587c  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
18:39:29.0680 0x587c  RpcLocator - ok
18:39:29.0692 0x587c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
18:39:29.0735 0x587c  RpcSs - ok
18:39:29.0739 0x587c  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
18:39:29.0770 0x587c  rspndr - ok
18:39:29.0784 0x587c  [ EE082E06A82FF630351D1E0EBBD3D8D0, 537F1A4108BDA72E8DD271466E7B7FCF39D4D55E4129AB35A409AB7AF2E7D219 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
18:39:29.0811 0x587c  RTL8167 - ok
18:39:29.0815 0x587c  [ 41F8F530DEDCF7DB8C567E527658A088, C859269018CC51D8557C33B45FD0ED9B1F80D505DEBC581249F6FB4648E22DEB ] rzendpt         C:\Windows\system32\DRIVERS\rzendpt.sys
18:39:29.0828 0x587c  rzendpt - ok
18:39:29.0835 0x587c  [ C2A49525F6CEEED97A1D9FC950AAF863, DAA57C1C446861C733D3BE668EB247E40CE3871EF8FA0BB91CEB074B7357E0D8 ] rzudd           C:\Windows\system32\DRIVERS\rzudd.sys
18:39:29.0852 0x587c  rzudd - ok
18:39:29.0863 0x587c  [ E5E981893D519D28ED3554BF618F8B92, 6CADF1BC93F57D6A93CFE326939A518A727D0C33A71CAD99630A7A579989C12C ] RzWizardService C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe
18:39:29.0886 0x587c  RzWizardService - detected UnsignedFile.Multi.Generic ( 1 )
18:39:32.0857 0x587c  Detect skipped due to KSN trusted
18:39:32.0857 0x587c  RzWizardService - ok
18:39:32.0862 0x587c  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
18:39:32.0889 0x587c  s3cap - ok
18:39:32.0894 0x587c  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs           C:\Windows\system32\lsass.exe
18:39:32.0919 0x587c  SamSs - ok
18:39:32.0927 0x587c  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
18:39:32.0950 0x587c  sbp2port - ok
18:39:32.0958 0x587c  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
18:39:32.0997 0x587c  SCardSvr - ok
18:39:33.0001 0x587c  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
18:39:33.0031 0x587c  scfilter - ok
18:39:33.0054 0x587c  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
18:39:33.0119 0x587c  Schedule - ok
18:39:33.0124 0x587c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
18:39:33.0154 0x587c  SCPolicySvc - ok
18:39:33.0157 0x587c  [ 1CA5A783B10EC897FCE91CF220D6C517, DCBCD9E90C73F883B9A55D972CF99F25373049B7684E6738E1E213A20369A5E6 ] scvad_simple    C:\Windows\system32\drivers\SplitCamAudio.sys
18:39:33.0172 0x587c  scvad_simple - ok
18:39:33.0179 0x587c  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
18:39:33.0200 0x587c  SDRSVC - ok
18:39:33.0233 0x587c  [ D777F1417D9BB9F66CD9D9C3B61F730F, 0CBD830EB9D2B0F1946131F20907793B2D68A3BCEEC3EA5416972149F73DC815 ] SDScannerService C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
18:39:33.0298 0x587c  SDScannerService - ok
18:39:33.0337 0x587c  [ 68D6C7F99BC73B88954D844FCCBEB2A0, F746861B103C8BE8EA234B9FCFBBDD2412C79FB65F2F1E0F5E6EBC0B34905FF1 ] SDUpdateService C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
18:39:33.0408 0x587c  SDUpdateService - ok
18:39:33.0415 0x587c  [ 9B9B368A8FF5CAF91D7A333CF62CD2CC, A4AE7FFBBAF983BFDE15B521ED162CBC4E6FC85BCDB200C75D45878B3FFDFA68 ] SDWSCService    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
18:39:33.0432 0x587c  SDWSCService - ok
18:39:33.0436 0x587c  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
18:39:33.0466 0x587c  secdrv - ok
18:39:33.0469 0x587c  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
18:39:33.0499 0x587c  seclogon - ok
18:39:33.0503 0x587c  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
18:39:33.0535 0x587c  SENS - ok
18:39:33.0538 0x587c  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
18:39:33.0556 0x587c  SensrSvc - ok
18:39:33.0559 0x587c  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
18:39:33.0574 0x587c  Serenum - ok
18:39:33.0578 0x587c  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
18:39:33.0597 0x587c  Serial - ok
18:39:33.0600 0x587c  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
18:39:33.0616 0x587c  sermouse - ok
18:39:33.0624 0x587c  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
18:39:33.0659 0x587c  SessionEnv - ok
18:39:33.0661 0x587c  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
18:39:33.0679 0x587c  sffdisk - ok
18:39:33.0682 0x587c  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
18:39:33.0699 0x587c  sffp_mmc - ok
18:39:33.0702 0x587c  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
18:39:33.0720 0x587c  sffp_sd - ok
18:39:33.0723 0x587c  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
18:39:33.0740 0x587c  sfloppy - ok
18:39:33.0752 0x587c  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
18:39:33.0794 0x587c  SharedAccess - ok
18:39:33.0804 0x587c  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:39:33.0846 0x587c  ShellHWDetection - ok
18:39:33.0849 0x587c  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
18:39:33.0863 0x587c  SiSRaid2 - ok
18:39:33.0868 0x587c  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
18:39:33.0885 0x587c  SiSRaid4 - ok
18:39:33.0895 0x587c  [ 050A4112B00BCA2E13314CDE48C1DEEE, 86C679CD494DEEB984372BF954EFBB8982AC7995FBF89FCF83BC228991D1B825 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
18:39:33.0916 0x587c  SkypeUpdate - ok
18:39:33.0921 0x587c  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
18:39:33.0954 0x587c  Smb - ok
18:39:33.0959 0x587c  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
18:39:33.0977 0x587c  SNMPTRAP - ok
18:39:33.0980 0x587c  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
18:39:33.0992 0x587c  spldr - ok
18:39:34.0006 0x587c  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
18:39:34.0040 0x587c  Spooler - ok
18:39:34.0106 0x587c  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
18:39:34.0230 0x587c  sppsvc - ok
18:39:34.0236 0x587c  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
18:39:34.0270 0x587c  sppuinotify - ok
18:39:34.0283 0x587c  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
18:39:34.0312 0x587c  srv - ok
18:39:34.0322 0x587c  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
18:39:34.0350 0x587c  srv2 - ok
18:39:34.0356 0x587c  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
18:39:34.0375 0x587c  srvnet - ok
18:39:34.0383 0x587c  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
18:39:34.0419 0x587c  SSDPSRV - ok
18:39:34.0423 0x587c  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
18:39:34.0458 0x587c  SstpSvc - ok
18:39:34.0474 0x587c  [ 189879824D01F9A0DD1D72259A120F50, D587688E9EF7C43319AB87EEA368C9310F3A8F4A8A6D8A6E427A54126C209DF0 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
18:39:34.0911 0x587c  Steam Client Service - ok
18:39:34.0918 0x587c  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
18:39:34.0936 0x587c  stexstor - ok
18:39:34.0951 0x587c  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
18:39:34.0994 0x587c  stisvc - ok
18:39:34.0999 0x587c  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
18:39:35.0014 0x587c  storflt - ok
18:39:35.0017 0x587c  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
18:39:35.0033 0x587c  StorSvc - ok
18:39:35.0037 0x587c  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
18:39:35.0051 0x587c  storvsc - ok
18:39:35.0054 0x587c  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
18:39:35.0066 0x587c  swenum - ok
18:39:35.0080 0x587c  [ F577910A133A592234EBAAD3F3AFA258, 36F514740EE2D2B2F7ABFFFA13D575233EC4CE774EB58BF889C09930FEF1F443 ] SwitchBoard     C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
18:39:35.0109 0x587c  SwitchBoard - detected UnsignedFile.Multi.Generic ( 1 )
18:39:38.0163 0x587c  Detect skipped due to KSN trusted
18:39:38.0163 0x587c  SwitchBoard - ok
18:39:38.0190 0x587c  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
18:39:38.0242 0x587c  swprv - ok
18:39:38.0283 0x587c  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
18:39:38.0359 0x587c  SysMain - ok
18:39:38.0366 0x587c  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:39:38.0389 0x587c  TabletInputService - ok
18:39:38.0399 0x587c  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
18:39:38.0439 0x587c  TapiSrv - ok
18:39:38.0443 0x587c  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
18:39:38.0476 0x587c  TBS - ok
18:39:38.0519 0x587c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
18:39:38.0586 0x587c  Tcpip - ok
18:39:38.0626 0x587c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
18:39:38.0684 0x587c  TCPIP6 - ok
18:39:38.0690 0x587c  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
18:39:38.0706 0x587c  tcpipreg - ok
18:39:38.0710 0x587c  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
18:39:38.0726 0x587c  TDPIPE - ok
18:39:38.0729 0x587c  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
18:39:38.0745 0x587c  TDTCP - ok
18:39:38.0750 0x587c  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
18:39:38.0782 0x587c  tdx - ok
18:39:38.0786 0x587c  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
18:39:38.0800 0x587c  TermDD - ok
18:39:38.0821 0x587c  [ 4FC4C50985E5B840F4D72E57286887B8, 0BCBB4A938803AE3A3532B6D8FFC85594AA9AEF5D8F9792684841BEA8780AE9E ] TermService     C:\Windows\System32\termsrv.dll
18:39:38.0854 0x587c  TermService - ok
18:39:38.0859 0x587c  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
18:39:38.0878 0x587c  Themes - ok
18:39:38.0882 0x587c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
18:39:38.0913 0x587c  THREADORDER - ok
18:39:38.0918 0x587c  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
18:39:38.0952 0x587c  TrkWks - ok
18:39:38.0959 0x587c  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:39:38.0995 0x587c  TrustedInstaller - ok
18:39:39.0000 0x587c  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
18:39:39.0016 0x587c  tssecsrv - ok
18:39:39.0021 0x587c  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
18:39:39.0038 0x587c  TsUsbFlt - ok
18:39:39.0044 0x587c  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
18:39:39.0077 0x587c  tunnel - ok
18:39:39.0081 0x587c  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
18:39:39.0095 0x587c  uagp35 - ok
18:39:39.0105 0x587c  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
18:39:39.0145 0x587c  udfs - ok
18:39:39.0150 0x587c  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
18:39:39.0170 0x587c  UI0Detect - ok
18:39:39.0175 0x587c  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
18:39:39.0190 0x587c  uliagpkx - ok
18:39:39.0193 0x587c  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
18:39:39.0210 0x587c  umbus - ok
18:39:39.0213 0x587c  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
18:39:39.0228 0x587c  UmPass - ok
18:39:39.0235 0x587c  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
18:39:39.0258 0x587c  UmRdpService - ok
18:39:39.0269 0x587c  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
18:39:39.0311 0x587c  upnphost - ok
18:39:39.0316 0x587c  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
18:39:39.0335 0x587c  usbaudio - ok
18:39:39.0340 0x587c  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
18:39:39.0358 0x587c  usbccgp - ok
18:39:39.0362 0x587c  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
18:39:39.0380 0x587c  usbcir - ok
18:39:39.0383 0x587c  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
18:39:39.0399 0x587c  usbehci - ok
18:39:39.0409 0x587c  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
18:39:39.0434 0x587c  usbhub - ok
18:39:39.0438 0x587c  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
18:39:39.0454 0x587c  usbohci - ok
18:39:39.0457 0x587c  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
18:39:39.0474 0x587c  usbprint - ok
18:39:39.0478 0x587c  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:39:39.0495 0x587c  USBSTOR - ok
18:39:39.0499 0x587c  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
18:39:39.0513 0x587c  usbuhci - ok
18:39:39.0517 0x587c  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
18:39:39.0549 0x587c  UxSms - ok
18:39:39.0552 0x587c  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc        C:\Windows\system32\lsass.exe
18:39:39.0567 0x587c  VaultSvc - ok
18:39:39.0570 0x587c  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
18:39:39.0584 0x587c  vdrvroot - ok
18:39:39.0598 0x587c  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
18:39:39.0647 0x587c  vds - ok
18:39:39.0651 0x587c  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
18:39:39.0668 0x587c  vga - ok
18:39:39.0673 0x587c  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
18:39:39.0703 0x587c  VgaSave - ok
18:39:39.0710 0x587c  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
18:39:39.0728 0x587c  vhdmp - ok
18:39:39.0732 0x587c  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
18:39:39.0745 0x587c  viaide - ok
18:39:39.0752 0x587c  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
18:39:39.0770 0x587c  vmbus - ok
18:39:39.0774 0x587c  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
18:39:39.0788 0x587c  VMBusHID - ok
18:39:39.0792 0x587c  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
18:39:39.0806 0x587c  volmgr - ok
18:39:39.0815 0x587c  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
18:39:39.0839 0x587c  volmgrx - ok
18:39:39.0848 0x587c  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
18:39:39.0869 0x587c  volsnap - ok
18:39:39.0876 0x587c  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
18:39:39.0894 0x587c  vsmraid - ok
18:39:39.0926 0x587c  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
18:39:40.0009 0x587c  VSS - ok
18:39:40.0013 0x587c  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
18:39:40.0030 0x587c  vwifibus - ok
18:39:40.0042 0x587c  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
18:39:40.0087 0x587c  W32Time - ok
18:39:40.0092 0x587c  [ A212A4F5D2BB731F9CC6E2C546A0B464, 32828D9A153519D3521F89419DCE91ABB25AD0601A525ED8947C1FA2434DF608 ] WacHidRouter    C:\Windows\system32\DRIVERS\wachidrouter.sys
18:39:40.0107 0x587c  WacHidRouter - ok
18:39:40.0111 0x587c  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
18:39:40.0127 0x587c  WacomPen - ok
18:39:40.0130 0x587c  [ E722E0C28881186D1B7E09A66C4D4DA5, 8BAF9D96706EE4251F20E850ECDF4201ADB04C9A8E31FD5C669F75E2299A0414 ] wacomrouterfilter C:\Windows\system32\DRIVERS\wacomrouterfilter.sys
18:39:40.0141 0x587c  wacomrouterfilter - ok
18:39:40.0145 0x587c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
18:39:40.0177 0x587c  WANARP - ok
18:39:40.0180 0x587c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
18:39:40.0209 0x587c  Wanarpv6 - ok
18:39:40.0240 0x587c  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
18:39:40.0301 0x587c  wbengine - ok
18:39:40.0309 0x587c  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
18:39:40.0334 0x587c  WbioSrvc - ok
18:39:40.0343 0x587c  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
18:39:40.0373 0x587c  wcncsvc - ok
18:39:40.0378 0x587c  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:39:40.0396 0x587c  WcsPlugInService - ok
18:39:40.0399 0x587c  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
18:39:40.0413 0x587c  Wd - ok
18:39:40.0434 0x587c  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
18:39:40.0471 0x587c  Wdf01000 - ok
18:39:40.0476 0x587c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
18:39:40.0498 0x587c  WdiServiceHost - ok
18:39:40.0502 0x587c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
18:39:40.0524 0x587c  WdiSystemHost - ok
18:39:40.0531 0x587c  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
18:39:40.0554 0x587c  WebClient - ok
18:39:40.0561 0x587c  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
18:39:40.0600 0x587c  Wecsvc - ok
18:39:40.0605 0x587c  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
18:39:40.0639 0x587c  wercplsupport - ok
18:39:40.0643 0x587c  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
18:39:40.0677 0x587c  WerSvc - ok
18:39:40.0680 0x587c  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
18:39:40.0709 0x587c  WfpLwf - ok
18:39:40.0712 0x587c  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
18:39:40.0725 0x587c  WIMMount - ok
18:39:40.0727 0x587c  WinDefend - ok
18:39:40.0731 0x587c  WinHttpAutoProxySvc - ok
18:39:40.0743 0x587c  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
18:39:40.0782 0x587c  Winmgmt - ok
18:39:40.0821 0x587c  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll
18:39:40.0907 0x587c  WinRM - ok
18:39:40.0915 0x587c  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
18:39:40.0933 0x587c  WinUsb - ok
18:39:40.0956 0x587c  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
18:39:41.0007 0x587c  Wlansvc - ok
18:39:41.0010 0x587c  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
18:39:41.0025 0x587c  WmiAcpi - ok
18:39:41.0035 0x587c  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
18:39:41.0057 0x587c  wmiApSrv - ok
18:39:41.0062 0x587c  WMPNetworkSvc - ok
18:39:41.0065 0x587c  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
18:39:41.0082 0x587c  WPCSvc - ok
18:39:41.0086 0x587c  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
18:39:41.0106 0x587c  WPDBusEnum - ok
18:39:41.0109 0x587c  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
18:39:41.0140 0x587c  ws2ifsl - ok
18:39:41.0144 0x587c  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
18:39:41.0166 0x587c  wscsvc - ok
18:39:41.0168 0x587c  WSearch - ok
18:39:41.0185 0x587c  [ 0B73D22D0662F7C98EF9AF083D7B7542, C42E2E19B5B23F954DA2B601F36872F4101C3C256F45347B6ED6F377562B6906 ] WTabletServicePro C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
18:39:41.0213 0x587c  WTabletServicePro - ok
18:39:41.0263 0x587c  [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv        C:\Windows\system32\wuaueng.dll
18:39:41.0350 0x587c  wuauserv - ok
18:39:41.0357 0x587c  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
18:39:41.0375 0x587c  WudfPf - ok
18:39:41.0381 0x587c  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
18:39:41.0400 0x587c  WUDFRd - ok
18:39:41.0406 0x587c  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
18:39:41.0426 0x587c  wudfsvc - ok
18:39:41.0435 0x587c  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
18:39:41.0460 0x587c  WwanSvc - ok
18:39:41.0480 0x587c  [ 4A5CE13408945E525503B5F73D29B9C5, D58BB31AF17752508EA67931BF170CE46877DC204FC5DA7EED5A078AEB0CA0FD ] xnacc           C:\Windows\system32\DRIVERS\xnacc.sys
18:39:41.0518 0x587c  xnacc - ok
18:39:41.0534 0x587c  [ DD0042F0C3B606A6A8B92D49AFB18AD6, 8D3BE4C93D02AF5F42EC46AF598D6DA40C61D467CB2FEE5E222F9C1E7A84B852 ] YahooAUService  C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
18:39:41.0564 0x587c  YahooAUService - ok
18:39:41.0567 0x587c  ================ Scan global ===============================
18:39:41.0571 0x587c  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
18:39:41.0579 0x587c  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
18:39:41.0590 0x587c  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
18:39:41.0597 0x587c  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
18:39:41.0608 0x587c  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
18:39:41.0617 0x587c  [ Global ] - ok
18:39:41.0617 0x587c  ================ Scan MBR ==================================
18:39:41.0619 0x587c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
18:39:41.0639 0x587c  \Device\Harddisk0\DR0 - ok
18:39:41.0641 0x587c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
18:39:41.0676 0x587c  \Device\Harddisk1\DR1 - ok
18:39:41.0679 0x587c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
18:39:41.0717 0x587c  \Device\Harddisk2\DR2 - ok
18:39:41.0720 0x587c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk3\DR3
18:39:41.0808 0x587c  \Device\Harddisk3\DR3 - ok
18:39:41.0809 0x587c  ================ Scan VBR ==================================
18:39:41.0812 0x587c  [ BA98100769B850A05D636E904887764E ] \Device\Harddisk0\DR0\Partition1
18:39:41.0812 0x587c  \Device\Harddisk0\DR0\Partition1 - ok
18:39:41.0814 0x587c  [ EB5CCA34DE839CA3B0FA533ADA3816B9 ] \Device\Harddisk0\DR0\Partition2
18:39:41.0814 0x587c  \Device\Harddisk0\DR0\Partition2 - ok
18:39:41.0817 0x587c  [ 51BA292ED80DF5AB291C16AFD94E4AA2 ] \Device\Harddisk0\DR0\Partition3
18:39:41.0818 0x587c  \Device\Harddisk0\DR0\Partition3 - ok
18:39:41.0820 0x587c  [ 63E02E1D0B9BA748CC14C9B1F3CE91BC ] \Device\Harddisk1\DR1\Partition1
18:39:41.0821 0x587c  \Device\Harddisk1\DR1\Partition1 - ok
18:39:41.0825 0x587c  [ 48DCFC0DABB01826500F7AB849AA6932 ] \Device\Harddisk2\DR2\Partition1
18:39:41.0870 0x587c  \Device\Harddisk2\DR2\Partition1 - ok
18:39:41.0873 0x587c  [ DE070B2B4B748192BE309A5D7E9ECFB0 ] \Device\Harddisk3\DR3\Partition1
18:39:41.0918 0x587c  \Device\Harddisk3\DR3\Partition1 - ok
18:39:41.0919 0x587c  ================ Scan generic autorun ======================
18:39:42.0157 0x587c  [ 72CD24BCDCAEABAC39CC4F10BAC97C22, E300BD5480259C7DFC2ED25D1CBF246CF1BE0FFEB0A060CABEC4BD15FA8FAFFE ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
18:39:42.0446 0x587c  RtHDVCpl - ok
18:39:42.0471 0x587c  [ F7123DD08DB0E254C62DB2B65FFE010C, 22638D929369244ADB68C10EC945B2BE2062E0DD59AB37D9A4B862D8BC55FBD8 ] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
18:39:42.0506 0x587c  AtherosBtStack - detected UnsignedFile.Multi.Generic ( 1 )
18:39:45.0439 0x587c  Detect skipped due to KSN trusted
18:39:45.0439 0x587c  AtherosBtStack - ok
18:39:45.0454 0x587c  [ 91894B8CCED018B2567C99F8F729F3D6, 5678B36722FB270B917F9E23A9CF7C8863B71665D2C81681F2D02C93CDF07739 ] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
18:39:45.0478 0x587c  AthBtTray - detected UnsignedFile.Multi.Generic ( 1 )
18:39:48.0467 0x587c  Detect skipped due to KSN trusted
18:39:48.0467 0x587c  AthBtTray - ok
18:39:48.0482 0x587c  [ 1315C5C5C54CE2AA37A155F97027DB59, 70CDA6AE7FF4FD08FAD931477C524957952EDC89985696FD988B9786A349C565 ] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
18:39:48.0508 0x587c  AdobeAAMUpdater-1.0 - ok
18:39:48.0513 0x587c  [ 9D51EA92A612B37E76E5E4621650C50A, 00BD61C8527A80C0F684882379A0AC2E5A54E8BBECC797087B960CDC8454C373 ] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
18:39:48.0528 0x587c  NUSB3MON - ok
18:39:48.0536 0x587c  [ 4A73AB8412D3AA6CFAD24051FF9DBFA7, 7C1F6BDECE92F2A58E88FC603F1BEE9B0F72130136AE9A368892323A9A327FD1 ] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
18:39:48.0554 0x587c  IAStorIcon - ok
18:39:48.0580 0x587c  [ 3CD5FD3FED5388DC01A072DB5D06C9CD, BED3D0CE4EF7A8D0FAB8B1E2E519D2B7F9BB81E62F5CBC6C968179FC20956165 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe
18:39:48.0615 0x587c  StartCCC - ok
18:39:48.0707 0x587c  [ C2D60F6277707014C1C670A4D27F36E8, 9F02C675BCE2BA500E8C1A4EA60BD553C1257836F5868126037E35772E9F251F ] C:\Program Files\AVAST Software\Avast\AvastUI.exe
18:39:48.0853 0x587c  AvastUI.exe - ok
18:39:48.0863 0x587c  [ CF0AF125246B2B3AE1D7298E8F600889, 2AC00A7FE261AF14CEB9BE22FE190E3294AD24A14CEF6963E5F16068240A5DCD ] C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe
18:39:48.0880 0x587c  RzWizard - detected UnsignedFile.Multi.Generic ( 1 )
18:39:52.0073 0x587c  Detect skipped due to KSN trusted
18:39:52.0073 0x587c  RzWizard - ok
18:39:52.0115 0x587c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
18:39:52.0181 0x587c  Sidebar - ok
18:39:52.0186 0x587c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
18:39:52.0207 0x587c  mctadmin - ok
18:39:52.0231 0x587c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
18:39:52.0278 0x587c  Sidebar - ok
18:39:52.0283 0x587c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
18:39:52.0302 0x587c  mctadmin - ok
18:39:52.0303 0x587c  SplitCam - ok
18:39:52.0305 0x587c  Waiting for KSN requests completion. In queue: 9
18:39:53.0305 0x587c  Waiting for KSN requests completion. In queue: 9
18:39:54.0305 0x587c  Waiting for KSN requests completion. In queue: 9
18:39:55.0305 0x587c  Waiting for KSN requests completion. In queue: 4
18:39:56.0347 0x587c  AV detected via SS2: avast! Antivirus, C:\Program Files\AVAST Software\Avast\VisthAux.exe ( 10.0.2206.692 ), 0x41000 ( enabled : updated )
18:39:56.0391 0x587c  Win FW state via NFP2: enabled
18:39:59.0298 0x587c  ============================================================
18:39:59.0298 0x587c  Scan finished
18:39:59.0298 0x587c  ============================================================
18:39:59.0311 0x5b74  Detected object count: 0
18:39:59.0311 0x5b74  Actual detected object count: 0
         

Nutzt Du nen Adblocker im Browser?

Nein, nutze ich nicht, aber es liegt auch nicht daran. Allein hier auf Trojaner-Board - Viren und Trojaner entfernen - kostenlos wenn ich durch die Treads klicke, kommen die Popups. Gerade jetzt kamm ein Popup von www.mybet.com...

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Immer noch?

Ich probiere es später, allerdings die Popups habe ich auch in IE und Chrome. Chrome kann ich noch deinstallieren, aber was mache ich mit IExplorer?

Das mit Revo-Uninstaller habe ich gemacht, leider hat nichts gebracht...das ding ist echt hartnäckig...soll ich wegen sowas Windows neu installieren?! WOW...