Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

Hallo cosinus,

GMER ist beim 2. Mal gelaufen. Die osam.exe wird sofort von McAfee als Trojaner gelöscht. Wenn ich McAfee abschalte beendet OSAM den Scan nicht. Das Ergebnis des Remover darunter

Grüße
intrus

Hier der GMER Log-File:

{\rtf1\ansi\ansicpg1252\deff0\deflang1031{\fonttbl{\f0\fswiss\fcharset0 Arial;}}
{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\f0\fs20 GMER 1.0.15.15281 - hxxp://www.gmer.net\par
Rootkit scan 2010-08-31 21:08:38\par
Windows 6.0.6002 Service Pack 2\par
Running: 8qhdetxd.exe; Driver: C:\\Users\\***\\AppData\\Local\\Temp\\ufryrpod.sys\par
\par
\par
---- System - GMER 1.0.15 ----\par
\par
Code \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x88434D88]\par
Code \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0x88434DB2]\par
Code \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x88434D9E]\par
Code \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0x88434D74]\par
Code \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection\par
\par
---- Kernel code sections - GMER 1.0.15 ----\par
\par
.text ntoskrnl.exe!ZwYieldExecution 82879C0E 5 Bytes JMP 88434D78 \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)\par
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 82A50510 5 Bytes JMP 88434DA2 \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)\par
PAGE ntoskrnl.exe!NtMapViewOfSection 82A50899 7 Bytes JMP 88434D8C \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)\par
PAGE ntoskrnl.exe!ZwTerminateProcess 82A6004F 5 Bytes JMP 88434DB6 \\SystemRoot\\system32\\drivers\\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)\par
.text C:\\Windows\\system32\\DRIVERS\\nvlddmkm.sys section is writeable [0x8CC0F340, 0x3448B7, 0xE8000020]\par
\par
---- User code sections - GMER 1.0.15 ----\par
\par
.text C:\\Windows\\system32\\svchost.exe[308] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00240FE5 \par
.text C:\\Windows\\system32\\svchost.exe[308] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00240000 \par
.text C:\\Windows\\system32\\svchost.exe[308] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00240FCA \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 002200A7 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00220F61 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 002200E7 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 002200D6 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00220060 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 0022000A \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00220FAF \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0022008C \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00220F7C \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00220F9E \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00220F8D \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00220025 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00220071 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00220F35 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00220FD4 \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00220FEF \par
.text C:\\Windows\\system32\\svchost.exe[308] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00220F50 \par
.text C:\\Windows\\system32\\svchost.exe[308] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00720042 \par
.text C:\\Windows\\system32\\svchost.exe[308] msvcrt.dll!system 77C6804B 5 Bytes JMP 00720027 \par
.text C:\\Windows\\system32\\svchost.exe[308] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00720FC8 \par
.text C:\\Windows\\system32\\svchost.exe[308] msvcrt.dll!_open 77C6D106 5 Bytes JMP 0072000C \par
.text C:\\Windows\\system32\\svchost.exe[308] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00720FB7 \par
.text C:\\Windows\\system32\\svchost.exe[308] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00720FEF \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00230F97 \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00230FBC \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00230FEF \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00230039 \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00230F86 \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 0023001E \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00230FDE \par
.text C:\\Windows\\system32\\svchost.exe[308] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00230FCD \par
.text C:\\Windows\\system32\\svchost.exe[308] WS2_32.dll!socket 769936D1 3 Bytes JMP 00250000 \par
.text C:\\Windows\\system32\\svchost.exe[308] WS2_32.dll!socket + 4 769936D5 1 Byte [89]\par
.text C:\\Windows\\Explorer.EXE[684] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 03FD000A \par
.text C:\\Windows\\Explorer.EXE[684] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 03FD0FEF \par
.text C:\\Windows\\Explorer.EXE[684] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 03FD001B \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 01CD00E2 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 01CD0F9C \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 01CD0F55 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 01CD0F70 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 01CD00AC \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 01CD0040 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 01CD0051 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 01CD0FB7 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 01CD0091 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 01CD0FD4 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 01CD0080 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 01CD0FE5 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 01CD00C7 \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 01CD0F3A \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 01CD001B \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 01CD000A \par
.text C:\\Windows\\Explorer.EXE[684] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 01CD0F81 \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 01CF0039 \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 01CF0FB2 \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 01CF0FEF \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 01CF0F97 \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 01CF004A \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 01CF0FCD \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 01CF0FDE \par
.text C:\\Windows\\Explorer.EXE[684] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 01CF001E \par
.text C:\\Windows\\Explorer.EXE[684] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 03FC003F \par
.text C:\\Windows\\Explorer.EXE[684] msvcrt.dll!system 77C6804B 5 Bytes JMP 03FC0FBE \par
.text C:\\Windows\\Explorer.EXE[684] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 03FC001D \par
.text C:\\Windows\\Explorer.EXE[684] msvcrt.dll!_open 77C6D106 5 Bytes JMP 03FC0000 \par
.text C:\\Windows\\Explorer.EXE[684] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 03FC002E \par
.text C:\\Windows\\Explorer.EXE[684] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 03FC0FE3 \par
.text C:\\Windows\\Explorer.EXE[684] WS2_32.dll!socket 769936D1 5 Bytes JMP 01CC0000 \par
.text C:\\Windows\\Explorer.EXE[684] WININET.dll!InternetOpenA 76ACD690 5 Bytes JMP 01CE000A \par
.text C:\\Windows\\Explorer.EXE[684] WININET.dll!InternetOpenW 76ACDB09 5 Bytes JMP 01CE0025 \par
.text C:\\Windows\\Explorer.EXE[684] WININET.dll!InternetOpenUrlA 76ACF3A4 5 Bytes JMP 01CE0FEF \par
.text C:\\Windows\\Explorer.EXE[684] WININET.dll!InternetOpenUrlW 76B16DDF 5 Bytes JMP 01CE0FCA \par
.text C:\\Windows\\system32\\services.exe[820] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 0019000A \par
.text C:\\Windows\\system32\\services.exe[820] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00190036 \par
.text C:\\Windows\\system32\\services.exe[820] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00190025 \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00180F4D \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00180F68 \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00180F32 \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 001800BF \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00180F8D \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00180025 \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00180040 \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0018009D \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00180F9E \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00180FCA \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00180FAF \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 0018005B \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00180082 \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00180F17 \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00180FEF \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 0018000A \par
.text C:\\Windows\\system32\\services.exe[820] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 001800AE \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 001B0FBC \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 001B0FCD \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 001B0000 \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 001B0054 \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 001B006F \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 001B0FDE \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 001B0FEF \par
.text C:\\Windows\\system32\\services.exe[820] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 001B002F \par
.text C:\\Windows\\system32\\services.exe[820] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00310FE5 \par
.text C:\\Windows\\system32\\services.exe[820] msvcrt.dll!system 77C6804B 5 Bytes JMP 00310070 \par
.text C:\\Windows\\system32\\services.exe[820] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 0031003A \par
.text C:\\Windows\\system32\\services.exe[820] msvcrt.dll!_open 77C6D106 5 Bytes JMP 0031000C \par
.text C:\\Windows\\system32\\services.exe[820] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00310055 \par
.text C:\\Windows\\system32\\services.exe[820] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00310029 \par
.text C:\\Windows\\system32\\services.exe[820] WS2_32.dll!socket 769936D1 5 Bytes JMP 001A0000 \par
.text C:\\Windows\\system32\\lsass.exe[948] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 000A0FE5 \par
.text C:\\Windows\\system32\\lsass.exe[948] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 000A0FC0 \par
.text C:\\Windows\\system32\\lsass.exe[948] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 000A0000 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00080F6D \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00080F7E \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00080F26 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00080F37 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 000800A2 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00080036 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00080FDB \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 000800B3 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00080087 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 0008006C \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00080FCA \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00080051 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00080FAD \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 000800D8 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00080025 \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 0008000A \par
.text C:\\Windows\\system32\\lsass.exe[948] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00080F52 \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00840F79 \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00840FAF \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00840000 \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00840F9E \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00840F68 \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 0084001B \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00840FE5 \par
.text C:\\Windows\\system32\\lsass.exe[948] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00840FCA \par
.text C:\\Windows\\system32\\lsass.exe[948] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00850FA8 \par
.text C:\\Windows\\system32\\lsass.exe[948] msvcrt.dll!system 77C6804B 5 Bytes JMP 00850FB9 \par
.text C:\\Windows\\system32\\lsass.exe[948] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00850FD4 \par
.text C:\\Windows\\system32\\lsass.exe[948] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00850FEF \par
.text C:\\Windows\\system32\\lsass.exe[948] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00850029 \par
.text C:\\Windows\\system32\\lsass.exe[948] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00850018 \par
.text C:\\Windows\\system32\\lsass.exe[948] WS2_32.dll!socket 769936D1 5 Bytes JMP 00830FEF \par
.text C:\\Windows\\system32\\svchost.exe[1136] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 008A0000 \par
.text C:\\Windows\\system32\\svchost.exe[1136] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 008A0FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1136] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 008A001B \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 002A0F31 \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 002A0F4C \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 002A0F05 \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 002A0F16 \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 002A0F5D \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 002A0FCD \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 002A0FBC \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreatePipe 769E8E6E 3 Bytes JMP 002A0077 \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreatePipe + 4 769E8E72 1 Byte [89]\par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 002A0F6E \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!LoadLibraryW 769E9362 3 Bytes JMP 002A0F90 \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!LoadLibraryW + 4 769E9366 1 Byte [89]\par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!LoadLibraryExA 769E94B4 3 Bytes JMP 002A0F7F \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!LoadLibraryExA + 4 769E94B8 1 Byte [89]\par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!LoadLibraryA 769E94DC 3 Bytes JMP 002A0FAB \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!LoadLibraryA + 4 769E94E0 1 Byte [89]\par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!VirtualProtectEx 769EDBDA 3 Bytes JMP 002A005C \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!VirtualProtectEx + 4 769EDBDE 1 Byte [89]\par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 002A00B7 \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 002A0FDE \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 002A0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1136] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 002A0092 \par
.text C:\\Windows\\system32\\svchost.exe[1136] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00300F8B \par
.text C:\\Windows\\system32\\svchost.exe[1136] msvcrt.dll!system 77C6804B 5 Bytes JMP 00300FA6 \par
.text C:\\Windows\\system32\\svchost.exe[1136] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00300FB7 \par
.text C:\\Windows\\system32\\svchost.exe[1136] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00300FEF \par
.text C:\\Windows\\system32\\svchost.exe[1136] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 0030000C \par
.text C:\\Windows\\system32\\svchost.exe[1136] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00300FD2 \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 002F0F9E \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 002F0FC0 \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 002F0000 \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 002F0FAF \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 002F0F83 \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 002F002C \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 002F001B \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 3 Bytes JMP 002F0FDB \par
.text C:\\Windows\\system32\\svchost.exe[1136] ADVAPI32.dll!RegOpenKeyExW + 4 77A37BA5 1 Byte [88]\par
.text C:\\Windows\\system32\\svchost.exe[1136] WS2_32.dll!socket 769936D1 5 Bytes JMP 00290000 \par
.text C:\\Windows\\system32\\svchost.exe[1144] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00750FEF \par
.text C:\\Windows\\system32\\svchost.exe[1144] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00750011 \par
.text C:\\Windows\\system32\\svchost.exe[1144] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00750000 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00740F63 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 007400B3 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00740F34 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 007400D5 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00740F92 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00740FEF \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00740040 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 007400A2 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00740FA3 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00740051 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 0074006C \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00740FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00740091 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 007400E6 \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0074001B \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 0074000A \par
.text C:\\Windows\\system32\\svchost.exe[1144] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 007400C4 \par
.text C:\\Windows\\system32\\svchost.exe[1144] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 007A0F88 \par
.text C:\\Windows\\system32\\svchost.exe[1144] msvcrt.dll!system 77C6804B 5 Bytes JMP 007A0FA3 \par
.text C:\\Windows\\system32\\svchost.exe[1144] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 007A0FC8 \par
.text C:\\Windows\\system32\\svchost.exe[1144] msvcrt.dll!_open 77C6D106 5 Bytes JMP 007A0000 \par
.text C:\\Windows\\system32\\svchost.exe[1144] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 007A001D \par
.text C:\\Windows\\system32\\svchost.exe[1144] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 007A0FE3 \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00770F7C \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00770FB2 \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00770FEF \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00770F97 \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00770F6B \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00770FCD \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00770FDE \par
.text C:\\Windows\\system32\\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 0077001E \par
.text C:\\Windows\\system32\\svchost.exe[1144] WS2_32.dll!socket 769936D1 5 Bytes JMP 00760FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1204] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00850FEF \par
.text C:\\Windows\\system32\\svchost.exe[1204] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00850FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1204] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 0085000A \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00840F28 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00840F4D \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00840EF2 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00840089 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00840067 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00840FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00840FB9 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00840F5E \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00840F8D \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00840025 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00840040 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00840F9E \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00840078 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 0084009A \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0084000A \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00840FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1204] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00840F17 \par
.text C:\\Windows\\system32\\svchost.exe[1204] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 008E0031 \par
.text C:\\Windows\\system32\\svchost.exe[1204] msvcrt.dll!system 77C6804B 5 Bytes JMP 008E0FA6 \par
.text C:\\Windows\\system32\\svchost.exe[1204] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 008E0FC1 \par
.text C:\\Windows\\system32\\svchost.exe[1204] msvcrt.dll!_open 77C6D106 5 Bytes JMP 008E0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1204] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 008E0016 \par
.text C:\\Windows\\system32\\svchost.exe[1204] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 008E0FD2 \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00870F83 \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 0087001B \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00870FEF \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00870F94 \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 0087004A \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00870FCA \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00870000 \par
.text C:\\Windows\\system32\\svchost.exe[1204] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00870FAF \par
.text C:\\Windows\\system32\\svchost.exe[1204] WS2_32.dll!socket 769936D1 5 Bytes JMP 00860FE5 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00BB000A \par
.text C:\\Windows\\System32\\svchost.exe[1268] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00BB0FD4 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00BB0FE5 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00AD00B5 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00AD009A \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00AD00D7 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00AD00C6 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00AD005D \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00AD0FD4 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00AD0FB9 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00AD0089 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00AD004C \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00AD0F8D \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00AD002F \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00AD0FA8 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00AD0078 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00AD00E8 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00AD0000 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00AD0FE5 \par
.text C:\\Windows\\System32\\svchost.exe[1268] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00AD0F54 \par
.text C:\\Windows\\System32\\svchost.exe[1268] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00F7005F \par
.text C:\\Windows\\System32\\svchost.exe[1268] msvcrt.dll!system 77C6804B 5 Bytes JMP 00F70FDE \par
.text C:\\Windows\\System32\\svchost.exe[1268] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00F70033 \par
.text C:\\Windows\\System32\\svchost.exe[1268] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00F70000 \par
.text C:\\Windows\\System32\\svchost.exe[1268] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00F70044 \par
.text C:\\Windows\\System32\\svchost.exe[1268] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00F70FEF \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00F60F94 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00F60FC0 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00F60000 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00F60FAF \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00F60F83 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00F60FE5 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00F60011 \par
.text C:\\Windows\\System32\\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00F60036 \par
.text C:\\Windows\\System32\\svchost.exe[1268] WS2_32.dll!socket 769936D1 5 Bytes JMP 00BC0000 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00650000 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00650FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 0065001B \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 0062007B \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00620F2B \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00620EE4 \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00620EFF \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00620F5E \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 0062000A \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 0062001B \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00620F3C \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00620F6F \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 0062002C \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00620F80 \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00620FAF \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00620F4D \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00620ED3 \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00620FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00620FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1308] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00620F10 \par
.text C:\\Windows\\system32\\svchost.exe[1308] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00640FBC \par
.text C:\\Windows\\system32\\svchost.exe[1308] msvcrt.dll!system 77C6804B 5 Bytes JMP 00640047 \par
.text C:\\Windows\\system32\\svchost.exe[1308] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00640022 \par
.text C:\\Windows\\system32\\svchost.exe[1308] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00640FEF \par
.text C:\\Windows\\system32\\svchost.exe[1308] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00640FCD \par
.text C:\\Windows\\system32\\svchost.exe[1308] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00640FDE \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00630062 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00630040 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00630FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00630051 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00630FAF \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00630025 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00630000 \par
.text C:\\Windows\\system32\\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00630FCA \par
.text C:\\Windows\\system32\\svchost.exe[1308] WS2_32.dll!socket 769936D1 5 Bytes JMP 00610000 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00E9000A \par
.text C:\\Windows\\system32\\svchost.exe[1316] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00E90FDE \par
.text C:\\Windows\\system32\\svchost.exe[1316] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00E90FEF \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 009D0F2B \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 009D0071 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 009D0096 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 009D0EFF \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 009D0056 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 009D0014 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 009D0FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 009D0F50 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 009D0F7C \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 009D0039 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 009D0F97 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 009D0FB2 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 009D0F61 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 009D0EE4 \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 009D0FDE \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 009D0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1316] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 009D0F1A \par
.text C:\\Windows\\system32\\svchost.exe[1316] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 009F0F7F \par
.text C:\\Windows\\system32\\svchost.exe[1316] msvcrt.dll!system 77C6804B 5 Bytes JMP 009F0014 \par
.text C:\\Windows\\system32\\svchost.exe[1316] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 009F0FB5 \par
.text C:\\Windows\\system32\\svchost.exe[1316] msvcrt.dll!_open 77C6D106 5 Bytes JMP 009F0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1316] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 009F0F9A \par
.text C:\\Windows\\system32\\svchost.exe[1316] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 009F0FC6 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 009E0073 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 009E0051 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 009E0000 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 009E0062 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 009E0FB6 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 009E0FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 009E0011 \par
.text C:\\Windows\\system32\\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 009E0036 \par
.text C:\\Windows\\system32\\svchost.exe[1316] WS2_32.dll!socket 769936D1 5 Bytes JMP 009C0000 \par
.text C:\\Windows\\System32\\svchost.exe[1344] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00F50FE5 \par
.text C:\\Windows\\System32\\svchost.exe[1344] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00F5000A \par
.text C:\\Windows\\System32\\svchost.exe[1344] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00F50FD4 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00F40097 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00F40F47 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00F40F1B \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00F400B2 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00F40F7A \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00F40FEF \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00F40FD4 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00F40F58 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00F40F8B \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00F40FB9 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00F40FA8 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00F40036 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00F40F69 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00F40F0A \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00F4001B \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00F40000 \par
.text C:\\Windows\\System32\\svchost.exe[1344] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00F40F36 \par
.text C:\\Windows\\System32\\svchost.exe[1344] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00FD004B \par
.text C:\\Windows\\System32\\svchost.exe[1344] msvcrt.dll!system 77C6804B 5 Bytes JMP 00FD003A \par
.text C:\\Windows\\System32\\svchost.exe[1344] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00FD0029 \par
.text C:\\Windows\\System32\\svchost.exe[1344] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00FD0000 \par
.text C:\\Windows\\System32\\svchost.exe[1344] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00FD0FCA \par
.text C:\\Windows\\System32\\svchost.exe[1344] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00FD0FEF \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00F80F7C \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00F80FA8 \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00F80FE5 \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00F80F97 \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00F80F61 \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00F80FCA \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00F80000 \par
.text C:\\Windows\\System32\\svchost.exe[1344] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00F80FB9 \par
.text C:\\Windows\\System32\\svchost.exe[1344] WS2_32.dll!socket 769936D1 5 Bytes JMP 00F60FEF \par
.text C:\\Windows\\system32\\svchost.exe[1360] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00E00000 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00E00FDE \par
.text C:\\Windows\\system32\\svchost.exe[1360] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00E00FEF \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00DE00AE \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00DE0F68 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00DE00EB \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00DE00D0 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00DE0F94 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00DE0FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00DE0040 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00DE0093 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00DE0FA5 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00DE0062 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00DE0FB6 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00DE0051 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00DE0F83 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00DE0106 \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00DE001B \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00DE000A \par
.text C:\\Windows\\system32\\svchost.exe[1360] kernel32.dll!WinExec

hier gehts weiter:

76A55CF7 5 Bytes JMP 00DE00BF \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 01690069 \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!system 77C6804B 5 Bytes JMP 01690FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 01690FEF \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_open 77C6D106 5 Bytes JMP 0169000C \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 01690044 \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 01690029 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00DF0FC0 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00DF0FD1 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00DF0000 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00DF0062 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00DF0F9B \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00DF0022 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00DF0011 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00DF003D \par
.text C:\\Windows\\system32\\svchost.exe[1360] WS2_32.dll!socket 769936D1 5 Bytes JMP 014E0FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00160FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00160FB9 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00160FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 001400B6 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00140F70 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00140F33 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00140F4E \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00140076 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00140FDE \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00140FCD \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0014009B \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00140065 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00140FB2 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00140054 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00140039 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00140F81 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 001400E5 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0014000A \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00140FEF \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00140F5F \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00180FA6 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!system 77C6804B 5 Bytes JMP 00180FB7 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00180016 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00180FEF \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00180027 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00180FD2 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00150FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 0015005B \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00150000 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00150080 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00150FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00150FEF \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 0015001B \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 0015004A \par
.text C:\\Windows\\system32\\svchost.exe[1488] WS2_32.dll!socket 769936D1 5 Bytes JMP 00170000 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 008B0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1540] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 008B0FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 008B0FDE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00890F46 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 0089008C \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 008900D3 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 008900AE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00890F75 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00890FDE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00890FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0089007B \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00890F86 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00890FA1 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00890043 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00890FB2 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 0089006A \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 008900EE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00890014 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00890FEF \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 0089009D \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 009A0F7C \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!system 77C6804B 5 Bytes JMP 009A0F97 \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 009A0000 \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_open 77C6D106 5 Bytes JMP 009A0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 009A0011 \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 009A0FC6 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExA 77A139AB 1 Byte [E9]\par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 008A0FAF \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 008A0FC0 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 008A0000 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 008A0051 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 008A006C \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 008A001B \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 008A0FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 008A002C \par
.text C:\\Windows\\system32\\svchost.exe[1540] WS2_32.dll!socket 769936D1 5 Bytes JMP 008C0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00F50000 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00F50FDB \par
.text C:\\Windows\\system32\\svchost.exe[1732] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00F50011 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00DD0F68 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00DD00AE \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00DD0F3C \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00DD00DD \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00DD0082 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00DD0022 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00DD0FDB \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00DD009D \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00DD0F9E \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00DD0FB9 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00DD005B \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00DD0FCA \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00DD0F8D \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00DD0F2B \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00DD0011 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00DD0000 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00DD0F57 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00F7004E \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!system 77C6804B 5 Bytes JMP 00F70FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00F70018 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00F70FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00F70033 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00F70FDE \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00F40FC0 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00F40047 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00F40FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00F40062 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00F40FAF \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00F40025 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00F4000A \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00F40036 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WS2_32.dll!socket 769936D1 5 Bytes JMP 00F60FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenA 76ACD690 5 Bytes JMP 00F30000 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenW 76ACDB09 5 Bytes JMP 00F30FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenUrlA 76ACF3A4 5 Bytes JMP 00F30FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenUrlW 76B16DDF 5 Bytes JMP 00F3001B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 03A9000A \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 03A90FE5 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 03A9001B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 03A6007B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 03A60060 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 03A600B1 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 03A60F10 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 03A60F57 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 03A60011 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 03A60FC0 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 03A60F35 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 03A60F68 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 03A60F94 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 03A60F79 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 03A60FA5 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 03A60F46 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 03A60EFF \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 03A60FE5 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 03A60000 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 03A6008C \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 03A8003D \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!system 77C6804B 5 Bytes JMP 03A80022 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 03A80FBC \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_open 77C6D106 5 Bytes JMP 03A80000 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 03A80011 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 03A80FE3 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 03A70036 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 03A7001B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 03A70FEF \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 03A70F94 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 03A70051 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 03A7000A \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 03A70FCA \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 03A70FB9 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] WS2_32.dll!socket 769936D1 5 Bytes JMP 03A50FE5 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00190000 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00190FD4 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00190FE5 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 001600AB \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00160F65 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 001600E1 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00160F4A \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00160F9B \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00160036 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00160047 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0016009A \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00160075 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00160058 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00160FB6 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00160FDB \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00160F80 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00160F2F \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0016001B \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 0016000A \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 001600C6 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wsystem 77C67F2F 1 Byte [E9]\par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00180033 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!system 77C6804B 5 Bytes JMP 00180FA8 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00180FCD \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00180FEF \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00180022 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00180FDE \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00170F83 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00170F9E \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 0017000A \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00170025 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00170F68 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00170FDE \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00170FEF \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00170FB9 \par
.text C:\\Windows\\System32\\svchost.exe[2156] WS2_32.dll!socket 769936D1 5 Bytes JMP 00090000 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 001F000A \par
.text C:\\Windows\\System32\\svchost.exe[2228] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 001F0FD4 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 001F0FEF \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 000B0EFA \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 000B0F15 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 000B0091 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 000B0076 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 000B0040 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 000B0FC3 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 000B0FA8 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 000B0F30 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 000B0F72 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 000B001E \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 000B002F \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 000B0F97 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 000B0F4B \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 000B00A2 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 000B0FDE \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 000B0FEF \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 000B005B \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 000D0FAD \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!system 77C6804B 5 Bytes JMP 000D0FC8 \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 000D001D \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_open 77C6D106 5 Bytes JMP 000D000C \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 000D0038 \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 000D0FEF \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 000C006C \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 000C0040 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 000C0000 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 000C005B \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 000C0FA5 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 000C001B \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 000C0FE5 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 000C0FD4 \par
.text C:\\Windows\\System32\\svchost.exe[2228] WS2_32.dll!socket 769936D1 5 Bytes JMP 000A0FEF \par
.text C:\\Windows\\system32\\svchost.exe[2368] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00700000 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00700FE5 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 0070001B \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 006D0F26 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 006D0F37 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 006D0087 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 006D0EF0 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 006D0F52 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 006D0FCA \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 006D0011 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 006D0058 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 006D0F6F \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 006D0F80 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 006D0022 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 006D0FA5 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 006D0047 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 006D0ED5 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 006D0FDB \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 006D0000 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 006D0F15 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 006F003D \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!system 77C6804B 5 Bytes JMP 006F0FB2 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 006F0011 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_open 77C6D106 5 Bytes JMP 006F0FE3 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 006F0022 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 006F0000 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 006E0073 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 006E0FD1 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 006E000A \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 006E0062 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 006E0084 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 006E002C \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 006E001B \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 006E0047 \par
.text C:\\Windows\\system32\\svchost.exe[2368] WS2_32.dll!socket 769936D1 5 Bytes JMP 00240000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 009F0FEF \par
.text C:\\Windows\\system32\\svchost.exe[2496] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 009F0FCD \par
.text C:\\Windows\\system32\\svchost.exe[2496] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 009F0FDE \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00980080 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00980F3A \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 009800C0 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 009800A5 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 0098005B \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00980FE5 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00980FC0 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00980F55 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 0098004A \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00980F9E \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00980F8D \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00980FAF \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00980F66 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00980F04 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0098001B \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00980000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00980F29 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 009E0049 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!system 77C6804B 5 Bytes JMP 009E0038 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 009E001D \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_open 77C6D106 5 Bytes JMP 009E0000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 009E0FC8 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 009E0FEF \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 009D0F7C \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 009D0FA8 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 009D0000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 009D0F8D \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 009D0F61 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 009D0FCA \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 009D0FDB \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 009D0FB9 \par
.text C:\\Windows\\system32\\svchost.exe[2496] WS2_32.dll!socket 769936D1 5 Bytes JMP 00930FEF \par
.text C:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe[2612] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 71639AE2 C:\\Program Files\\Common Files\\McAfee\\McProxy\\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)\par
.text C:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe[2612] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 71639A20 C:\\Program Files\\Common Files\\McAfee\\McProxy\\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)\par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00040FE5 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 0004000A \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00040FD4 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 0001008E \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00010F48 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00010F08 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 0001009F \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00010058 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 0001001B \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 0001002C \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00010F63 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00010F74 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00010F9B \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 0001003D \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00010FB6 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00010073 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00010EF7 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00010000 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00010FEF \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00010F2D \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00070049 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!system 77C6804B 5 Bytes JMP 00070038 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 0007000C \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00070FE3 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00070027 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00070FD2 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00080FDE \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00080065 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 0008000A \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00080076 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00080FCD \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00080FEF \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00080025 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00080040 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] WS2_32.dll!socket 769936D1 5 Bytes JMP 00140FE5 \par
\par
---- User IAT/EAT - GMER 1.0.15 ----\par
\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [747B7817] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7480A86D] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [747BBB22] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [747AF695] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdiplusStartup] [747B75E9] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [747AE7CA] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [747E8395] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [747BDA60] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [747AFFFA] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [747AFF61] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [747A71CF] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7483CAE2] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [747DC8D8] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [747AD968] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipFree] [747A6853] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipAlloc] [747A687E] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [747B2AD1] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe[1804] @ C:\\Windows\\system32\\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [00D276E0] C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)\par
IAT C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe[1804] @ C:\\Windows\\system32\\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [00D27740] C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)\par
\par
---- Devices - GMER 1.0.15 ----\par
\par
AttachedDevice \\FileSystem\\Ntfs \\Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)\par
AttachedDevice \\Driver\\kbdclass \\Device\\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)\par
AttachedDevice \\Driver\\tdx \\Device\\Tcp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)\par
\par
Device \\Driver\\BTHUSB \\Device\\00000071 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)\par
Device \\Driver\\BTHUSB \\Device\\00000073 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)\par
\par
AttachedDevice \\Driver\\tdx \\Device\\Udp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)\par
\par
---- Registry - GMER 1.0.15 ----\par
\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ca0 \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0cab \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ccf \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076109d093 0xBE 0x71 0x6F 0xA2 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0007610a45c5 0x63 0x0B 0x36 0x42 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0012471a5b4d 0x5A 0x05 0x5B 0xF1 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0001e3be7d5f 0x72 0x1B 0x9B 0x26 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076108f7fb 0xA3 0xB6 0xBA 0xAD ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ca0 (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0cab (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ccf (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076109d093 0xBE 0x71 0x6F 0xA2 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0007610a45c5 0x63 0x0B 0x36 0x42 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0012471a5b4d 0x5A 0x05 0x5B 0xF1 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0001e3be7d5f 0x72 0x1B 0x9B 0x26 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076108f7fb 0xA3 0xB6 0xBA 0xAD ...\par
\par
---- EOF - GMER 1.0.15 ----\par
}
#

Hier das Ergebnis des bootkit_remover:

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.1.0.0
OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6
002), 32-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000002`80100000
Boot sector MD5 is: 4b154a99a615e82aee4f69fabfe5ed3d

Size Device Name MBR Status
--------------------------------------------
186 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Done;
Press any key to quit...

Hallo cosinus,

Die osam.exe wird von irgendeinem McAfee Shield, den ich nicht abschalten kann, während des Scans gelöscht. Selbst wen ich McAfee aus der autostart lösche, wird der Scan unterbrochen und die osam.exe ist gelöscht. Vielleicht hast Du ja dazu eine Idee.

Danke und Grüße
intrus