GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-02-15 17:32:16 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 PLEXTOR_PX-128M5M rev.1.01 119,24GB Running: iu2obtvb.exe; Driver: C:\Users\Adam\AppData\Local\Temp\aftcqaow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1728] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075c81401 2 bytes JMP 7769b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075c81419 2 bytes JMP 7769b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075c81431 2 bytes JMP 77718ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075c8144a 2 bytes CALL 776748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075c814dd 2 bytes JMP 777187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075c814f5 2 bytes JMP 77718978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075c8150d 2 bytes JMP 77718698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075c81525 2 bytes JMP 77718a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075c8153d 2 bytes JMP 7768fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075c81555 2 bytes JMP 776968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075c8156d 2 bytes JMP 77718f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075c81585 2 bytes JMP 77718ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075c8159d 2 bytes JMP 7771865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075c815b5 2 bytes JMP 7768fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075c815cd 2 bytes JMP 7769b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075c816b2 2 bytes JMP 77718e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075c816bd 2 bytes JMP 777185f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000077678791 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075c81401 2 bytes JMP 7769b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075c81419 2 bytes JMP 7769b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075c81431 2 bytes JMP 77718ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075c8144a 2 bytes CALL 776748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075c814dd 2 bytes JMP 777187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075c814f5 2 bytes JMP 77718978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075c8150d 2 bytes JMP 77718698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075c81525 2 bytes JMP 77718a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075c8153d 2 bytes JMP 7768fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075c81555 2 bytes JMP 776968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075c8156d 2 bytes JMP 77718f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075c81585 2 bytes JMP 77718ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075c8159d 2 bytes JMP 7771865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075c815b5 2 bytes JMP 7768fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075c815cd 2 bytes JMP 7769b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075c816b2 2 bytes JMP 77718e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[2308] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075c816bd 2 bytes JMP 777185f1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\vmnat.exe[2880] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 4 000000006dd513b0 2 bytes JMP 75de5660 C:\Windows\syswow64\SHELL32.dll .text C:\Windows\SysWOW64\vmnat.exe[2880] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 20 000000006dd513c0 2 bytes CALL 76ba9cee C:\Windows\syswow64\msvcrt.dll .text ... * 20 .text C:\Windows\SysWOW64\vmnat.exe[2880] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 22 000000006dd5153e 2 bytes CALL 75e7777c C:\Windows\syswow64\SHELL32.dll .text C:\Windows\SysWOW64\vmnat.exe[2880] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 43 000000006dd51553 2 bytes CALL 776710ff C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075c81401 2 bytes JMP 7769b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075c81419 2 bytes JMP 7769b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075c81431 2 bytes JMP 77718ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075c8144a 2 bytes CALL 776748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075c814dd 2 bytes JMP 777187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075c814f5 2 bytes JMP 77718978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075c8150d 2 bytes JMP 77718698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075c81525 2 bytes JMP 77718a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075c8153d 2 bytes JMP 7768fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075c81555 2 bytes JMP 776968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075c8156d 2 bytes JMP 77718f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075c81585 2 bytes JMP 77718ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075c8159d 2 bytes JMP 7771865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075c815b5 2 bytes JMP 7768fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075c815cd 2 bytes JMP 7769b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075c816b2 2 bytes JMP 77718e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075c816bd 2 bytes JMP 777185f1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef702dc88 5 bytes JMP 000007fff6e200d8 .text C:\Windows\system32\Dwm.exe[3272] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef702de10 5 bytes JMP 000007fff6e20110 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000077671f0e 7 bytes JMP 000000016ceb3550 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000077675bad 7 bytes JMP 000000016ceb37f0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000077681409 7 bytes JMP 000000016ceb3650 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007768ea45 7 bytes JMP 000000016ceb3540 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000077718e24 7 bytes JMP 000000016ceb3310 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000077718ea9 5 bytes JMP 000000016ceb33c0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000777191ff 5 bytes JMP 000000016ceb3320 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000769c1d29 5 bytes JMP 000000016ceb32b0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000769c1dd7 5 bytes JMP 000000016ceb3270 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000769c2ab1 5 bytes JMP 000000016ceb33d0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000769c2d17 5 bytes JMP 000000016ceb30b0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000077788a29 5 bytes JMP 000000016ceb2c60 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000077794572 5 bytes JMP 000000016ceb3030 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000777ae567 5 bytes JMP 000000016ceb30a0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000777e7a5c 5 bytes JMP 000000016ceb3020 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007755e96b 5 bytes JMP 000000016ceb2cd0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007755eba5 5 bytes JMP 000000016ceb2ce0 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075915ea5 5 bytes JMP 000000016ceb2c20 .text C:\ProgramData\DatacardService\DCSHelper.exe[3632] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075949d0b 5 bytes JMP 000000016ceb2bb0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3668] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3752] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe[3848] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\ESET\ESET Smart Security\egui.exe[3872] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3924] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000077671f0e 7 bytes JMP 000000016ceb3550 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000077675bad 7 bytes JMP 000000016ceb37f0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000077681409 7 bytes JMP 000000016ceb3650 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007768ea45 7 bytes JMP 000000016ceb3540 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000077718e24 7 bytes JMP 000000016ceb3310 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000077718ea9 5 bytes JMP 000000016ceb33c0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000777191ff 5 bytes JMP 000000016ceb3320 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000769c1d29 5 bytes JMP 000000016ceb32b0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000769c1dd7 5 bytes JMP 000000016ceb3270 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000769c2ab1 5 bytes JMP 000000016ceb33d0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000769c2d17 5 bytes JMP 000000016ceb30b0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000077788a29 5 bytes JMP 000000016ceb2c60 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000077794572 5 bytes JMP 000000016ceb3030 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000777ae567 5 bytes JMP 000000016ceb30a0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000777e7a5c 5 bytes JMP 000000016ceb3020 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007755e96b 5 bytes JMP 000000016ceb2cd0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007755eba5 5 bytes JMP 000000016ceb2ce0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075915ea5 5 bytes JMP 000000016ceb2c20 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3952] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075949d0b 5 bytes JMP 000000016ceb2bb0 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffd900180 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffd9000d8 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffd900148 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffd900110 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffd9001f0 .text C:\Program Files\Windows Sidebar\sidebar.exe[3980] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffd9001b8 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\Sandboxie\SbieCtrl.exe[4024] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Windows\System32\StikyNot.exe[3584] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4260] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000077671f0e 7 bytes JMP 000000016ceb3550 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000077675bad 7 bytes JMP 000000016ceb37f0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000077681409 7 bytes JMP 000000016ceb3650 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007768ea45 7 bytes JMP 000000016ceb3540 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000077718e24 7 bytes JMP 000000016ceb3310 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000077718ea9 5 bytes JMP 000000016ceb33c0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000777191ff 5 bytes JMP 000000016ceb3320 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000769c1d29 5 bytes JMP 000000016ceb32b0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000769c1dd7 5 bytes JMP 000000016ceb3270 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000769c2ab1 5 bytes JMP 000000016ceb33d0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000769c2d17 5 bytes JMP 000000016ceb30b0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000077788a29 5 bytes JMP 000000016ceb2c60 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000077794572 5 bytes JMP 000000016ceb3030 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000777ae567 5 bytes JMP 000000016ceb30a0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000777e7a5c 5 bytes JMP 000000016ceb3020 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007755e96b 5 bytes JMP 000000016ceb2cd0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007755eba5 5 bytes JMP 000000016ceb2ce0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075915ea5 5 bytes JMP 000000016ceb2c20 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075949d0b 5 bytes JMP 000000016ceb2bb0 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000075c81401 2 bytes JMP 7769b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000075c81419 2 bytes JMP 7769b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000075c81431 2 bytes JMP 77718ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 0000000075c8144a 2 bytes CALL 776748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 0000000075c814dd 2 bytes JMP 777187a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075c814f5 2 bytes JMP 77718978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 0000000075c8150d 2 bytes JMP 77718698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075c81525 2 bytes JMP 77718a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 0000000075c8153d 2 bytes JMP 7768fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000075c81555 2 bytes JMP 776968ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 0000000075c8156d 2 bytes JMP 77718f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000075c81585 2 bytes JMP 77718ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 0000000075c8159d 2 bytes JMP 7771865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 0000000075c815b5 2 bytes JMP 7768fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 0000000075c815cd 2 bytes JMP 7769b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 0000000075c816b2 2 bytes JMP 77718e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe[4332] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 0000000075c816bd 2 bytes JMP 777185f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000077671f0e 7 bytes JMP 000000016ceb3550 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000077675bad 7 bytes JMP 000000016ceb37f0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000077681409 7 bytes JMP 000000016ceb3650 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007768ea45 7 bytes JMP 000000016ceb3540 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000077718e24 7 bytes JMP 000000016ceb3310 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000077718ea9 5 bytes JMP 000000016ceb33c0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000777191ff 5 bytes JMP 000000016ceb3320 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000769c1d29 5 bytes JMP 000000016ceb32b0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000769c1dd7 5 bytes JMP 000000016ceb3270 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000769c2ab1 5 bytes JMP 000000016ceb33d0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000769c2d17 5 bytes JMP 000000016ceb30b0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007755e96b 5 bytes JMP 000000016ceb2cd0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007755eba5 5 bytes JMP 000000016ceb2ce0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000077788a29 5 bytes JMP 000000016ceb2c60 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000077794572 5 bytes JMP 000000016ceb3030 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000777ae567 5 bytes JMP 000000016ceb30a0 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000777e7a5c 5 bytes JMP 000000016ceb3020 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075915ea5 5 bytes JMP 000000016ceb2c20 .text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4444] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075949d0b 5 bytes JMP 000000016ceb2bb0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000077671f0e 7 bytes JMP 000000016ceb3550 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000077675bad 7 bytes JMP 000000016ceb37f0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000077681409 7 bytes JMP 000000016ceb3650 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007768ea45 7 bytes JMP 000000016ceb3540 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000077718e24 7 bytes JMP 000000016ceb3310 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000077718ea9 5 bytes JMP 000000016ceb33c0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000777191ff 5 bytes JMP 000000016ceb3320 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000769c1d29 5 bytes JMP 000000016ceb32b0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000769c1dd7 5 bytes JMP 000000016ceb3270 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000769c2ab1 5 bytes JMP 000000016ceb33d0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000769c2d17 5 bytes JMP 000000016ceb30b0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000077788a29 5 bytes JMP 000000016ceb2c60 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000077794572 5 bytes JMP 000000016ceb3030 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000777ae567 5 bytes JMP 000000016ceb30a0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000777e7a5c 5 bytes JMP 000000016ceb3020 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007755e96b 5 bytes JMP 000000016ceb2cd0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007755eba5 5 bytes JMP 000000016ceb2ce0 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075915ea5 5 bytes JMP 000000016ceb2c20 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe[4568] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075949d0b 5 bytes JMP 000000016ceb2bb0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4976] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Windows\system32\igfxEM.exe[1584] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Windows\system32\igfxHK.exe[5128] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075c81401 2 bytes JMP 7769b21b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075c81419 2 bytes JMP 7769b346 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075c81431 2 bytes JMP 77718ea9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075c8144a 2 bytes CALL 776748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075c814dd 2 bytes JMP 777187a2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075c814f5 2 bytes JMP 77718978 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075c8150d 2 bytes JMP 77718698 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075c81525 2 bytes JMP 77718a62 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075c8153d 2 bytes JMP 7768fca8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075c81555 2 bytes JMP 776968ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075c8156d 2 bytes JMP 77718f61 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075c81585 2 bytes JMP 77718ac2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075c8159d 2 bytes JMP 7771865c C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075c815b5 2 bytes JMP 7768fd41 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075c815cd 2 bytes JMP 7769b2dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075c816b2 2 bytes JMP 77718e24 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[5784] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075c816bd 2 bytes JMP 777185f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feffa97490 11 bytes JMP 000007fffdab0228 .text C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe[1520] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feffaabf00 7 bytes JMP 000007fffdab0260 .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6088] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6088] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6088] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6088] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6088] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6088] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000077671f0e 7 bytes JMP 000000016ceb3550 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000077675bad 7 bytes JMP 000000016ceb37f0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000077681409 7 bytes JMP 000000016ceb3650 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007768ea45 7 bytes JMP 000000016ceb3540 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000077718e24 7 bytes JMP 000000016ceb3310 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000077718ea9 5 bytes JMP 000000016ceb33c0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000777191ff 5 bytes JMP 000000016ceb3320 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000769c1d29 5 bytes JMP 000000016ceb32b0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000769c1dd7 5 bytes JMP 000000016ceb3270 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000769c2ab1 5 bytes JMP 000000016ceb33d0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000769c2d17 5 bytes JMP 000000016ceb30b0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000077788a29 5 bytes JMP 000000016ceb2c60 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000077794572 5 bytes JMP 000000016ceb3030 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000777ae567 5 bytes JMP 000000016ceb30a0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000777e7a5c 5 bytes JMP 000000016ceb3020 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007755e96b 5 bytes JMP 000000016ceb2cd0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007755eba5 5 bytes JMP 000000016ceb2ce0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075915ea5 5 bytes JMP 000000016ceb2c20 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075949d0b 5 bytes JMP 000000016ceb2bb0 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075c81401 2 bytes JMP 7769b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075c81419 2 bytes JMP 7769b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075c81431 2 bytes JMP 77718ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075c8144a 2 bytes CALL 776748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075c814dd 2 bytes JMP 777187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075c814f5 2 bytes JMP 77718978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075c8150d 2 bytes JMP 77718698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075c81525 2 bytes JMP 77718a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075c8153d 2 bytes JMP 7768fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075c81555 2 bytes JMP 776968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075c8156d 2 bytes JMP 77718f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075c81585 2 bytes JMP 77718ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075c8159d 2 bytes JMP 7771865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075c815b5 2 bytes JMP 7768fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075c815cd 2 bytes JMP 7769b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075c816b2 2 bytes JMP 77718e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Cisco Systems\VPN Client\vpngui.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075c816bd 2 bytes JMP 777185f1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007793a400 7 bytes JMP 000000016fff0228 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077943f20 5 bytes JMP 000000016fff0180 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007795ffb0 5 bytes JMP 000000016fff01b8 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007796f2e0 5 bytes JMP 000000016fff0110 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077999a30 7 bytes JMP 000000016fff00d8 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779a94c0 5 bytes JMP 000000016fff0148 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779c87e0 7 bytes JMP 000000016fff01f0 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdac2db0 5 bytes JMP 000007fffdab0180 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdac37d0 7 bytes JMP 000007fffdab00d8 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdac8ef0 6 bytes JMP 000007fffdab0148 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdadaf60 5 bytes JMP 000007fffdab0110 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff4389f0 8 bytes JMP 000007fffdab01f0 .text C:\Users\Adam\Downloads\FRST64.exe[7716] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff43be50 8 bytes JMP 000007fffdab01b8 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000077671f0e 7 bytes JMP 000000016ceb3550 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000077675bad 7 bytes JMP 000000016ceb37f0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000077681409 7 bytes JMP 000000016ceb3650 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007768ea45 7 bytes JMP 000000016ceb3540 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000077718e24 7 bytes JMP 000000016ceb3310 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000077718ea9 5 bytes JMP 000000016ceb33c0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000777191ff 5 bytes JMP 000000016ceb3320 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000769c1d29 5 bytes JMP 000000016ceb32b0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000769c1dd7 5 bytes JMP 000000016ceb3270 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000769c2ab1 5 bytes JMP 000000016ceb33d0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000769c2d17 5 bytes JMP 000000016ceb30b0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007755e96b 5 bytes JMP 000000016ceb2cd0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007755eba5 5 bytes JMP 000000016ceb2ce0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000077788a29 5 bytes JMP 000000016ceb2c60 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000077794572 5 bytes JMP 000000016ceb3030 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000777ae567 5 bytes JMP 000000016ceb30a0 .text C:\Users\Adam\Downloads\iu2obtvb.exe[5712] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000777e7a5c 5 bytes JMP 000000016ceb3020 ---- Threads - GMER 2.1 ---- Thread System [4:188] fffffa8010cf2810 ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2648](2013-03-18 13:51:20) 000000006fbc0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2648](2013-03-18 13:51:20) 000000006e940000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2648](2013-03-18 13:51:20) 000000006a1c0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2648](2013-03-18 13:51:20) 000000006ff00000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2648](2013-03-18 13:51:20) 0000000002320000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2648](2013-03-18 13:51:20) 000000006ed40000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:28) 00000000738f0000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 00000000735e0000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332](2015-02-10 21:00:30) 0000000073520000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 0000000073130000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (ICU I18N DLL/The ICU Project)(2015-02-10 21:00:30) 000000004a900000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (ICU Common DLL/The ICU Project)(2015-02-10 21:00:30) 0000000004450000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (ICU Data DLL/The ICU Project)(2015-02-10 21:00:30) 000000004ad00000 Library c:\users\adam\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptjzsvx.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332](2015-02-13 18:03:54) 0000000003f30000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 0000000072bb0000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:26) 0000000068280000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 000000006aec0000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 0000000068020000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 000000006d420000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332](2015-02-10 21:00:30) 0000000072ba0000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:26) 000000006d3f0000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 000000006d3b0000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24) 000000006d360000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332](2015-02-10 21:00:28) 000000006cf20000 Library C:\Users\Adam\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Adam\AppData\Roaming\Dropbox\bin\Dropbox.exe [4332](2015-02-10 21:00:28) 000000006d2d0000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74e5431f8768 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74e5431f8768@18e2c2ee0884 0x76 0x8D 0x7E 0x25 ... Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{A36458AF-EFBD-4758-8E57-51F71C82ADA8}@InterfaceName isatap.{3F55EFBE-C9F0-45FA-ACF9-BFD6D9F1D17F} Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{A36458AF-EFBD-4758-8E57-51F71C82ADA8}@ReusableType 0 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74e5431f8768 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74e5431f8768@18e2c2ee0884 0x76 0x8D 0x7E 0x25 ... ---- Files - GMER 2.1 ---- File C:\Users\Adam\AppData\Local\Mozilla\Firefox\Profiles\hacdjy7o.default\cache2\entries\493DF564B6215EA180F8D40BEA3FBCB4C11BE9EE 283 bytes ---- EOF - GMER 2.1 ----