GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-26 16:17:02 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 HGST_HTS721010A9E630 rev.JB0OA3B0 931,51GB Running: 4ncptqkh.exe; Driver: C:\Users\Donek\AppData\Local\Temp\kwddikog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000076c3a3e0 7 bytes JMP 000000016fff0228 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000076c43f00 5 bytes JMP 000000016fff0180 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000076c5ffd0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000076c6f350 5 bytes JMP 000000016fff0110 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000076c99aa0 7 bytes JMP 000000016fff00d8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000076ca9530 5 bytes JMP 000000016fff0148 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000076cc8850 7 bytes JMP 000000016fff01f0 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcd00228 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1252] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcd00260 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef759dc88 5 bytes JMP 000007fff75700d8 .text C:\Windows\system32\Dwm.exe[1944] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef759de10 5 bytes JMP 000007fff7570110 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000076c3a3e0 7 bytes JMP 000000016fff0228 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000076c43f00 5 bytes JMP 000000016fff0180 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000076c5ffd0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000076c6f350 5 bytes JMP 000000016fff0110 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000076c99aa0 7 bytes JMP 000000016fff00d8 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000076ca9530 5 bytes JMP 000000016fff0148 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000076cc8850 7 bytes JMP 000000016fff01f0 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcd00228 .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1584] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcd00260 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074dc1401 2 bytes JMP 750bb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074dc1419 2 bytes JMP 750bb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074dc1431 2 bytes JMP 75138f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074dc144a 2 bytes CALL 7509489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074dc14dd 2 bytes JMP 75138822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074dc14f5 2 bytes JMP 751389f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074dc150d 2 bytes JMP 75138718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074dc1525 2 bytes JMP 75138ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074dc153d 2 bytes JMP 750afca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074dc1555 2 bytes JMP 750b68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074dc156d 2 bytes JMP 75138fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074dc1585 2 bytes JMP 75138b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074dc159d 2 bytes JMP 751386dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074dc15b5 2 bytes JMP 750afd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074dc15cd 2 bytes JMP 750bb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074dc16b2 2 bytes JMP 75138ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\CmdServer\EasySettingsCmdServer.exe[2084] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074dc16bd 2 bytes JMP 75138671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075098781 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000074dc1401 2 bytes JMP 750bb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000074dc1419 2 bytes JMP 750bb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000074dc1431 2 bytes JMP 75138f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000074dc144a 2 bytes CALL 7509489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000074dc14dd 2 bytes JMP 75138822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000074dc14f5 2 bytes JMP 751389f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000074dc150d 2 bytes JMP 75138718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000074dc1525 2 bytes JMP 75138ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000074dc153d 2 bytes JMP 750afca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000074dc1555 2 bytes JMP 750b68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000074dc156d 2 bytes JMP 75138fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000074dc1585 2 bytes JMP 75138b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000074dc159d 2 bytes JMP 751386dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000074dc15b5 2 bytes JMP 750afd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000074dc15cd 2 bytes JMP 750bb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000074dc16b2 2 bytes JMP 75138ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2092] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000074dc16bd 2 bytes JMP 75138671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000076c3a3e0 7 bytes JMP 000000016fff0228 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000076c43f00 5 bytes JMP 000000016fff0180 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000076c5ffd0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000076c6f350 5 bytes JMP 000000016fff0110 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000076c99aa0 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000076ca9530 5 bytes JMP 000000016fff0148 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000076cc8850 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcd00228 .text C:\Program Files\Elantech\ETDCtrl.exe[2112] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcd00260 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000076c3a3e0 7 bytes JMP 000000016fff0228 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000076c43f00 5 bytes JMP 000000016fff0180 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000076c5ffd0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000076c6f350 5 bytes JMP 000000016fff0110 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000076c99aa0 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000076ca9530 5 bytes JMP 000000016fff0148 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000076cc8850 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcd00228 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2120] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcd00260 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 0000000100c9f046 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000074de5ea5 5 bytes JMP 00000001729b2970 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000074e19d0b 5 bytes JMP 00000001729b2900 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074dc1401 2 bytes JMP 750bb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074dc1419 2 bytes JMP 750bb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074dc1431 2 bytes JMP 75138f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074dc144a 2 bytes CALL 7509489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074dc14dd 2 bytes JMP 75138822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074dc14f5 2 bytes JMP 751389f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074dc150d 2 bytes JMP 75138718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074dc1525 2 bytes JMP 75138ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074dc153d 2 bytes JMP 750afca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074dc1555 2 bytes JMP 750b68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074dc156d 2 bytes JMP 75138fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074dc1585 2 bytes JMP 75138b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074dc159d 2 bytes JMP 751386dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074dc15b5 2 bytes JMP 750afd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074dc15cd 2 bytes JMP 750bb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074dc16b2 2 bytes JMP 75138ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074dc16bd 2 bytes JMP 75138671 C:\Windows\syswow64\kernel32.dll .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcd00228 .text C:\Windows\System32\igfxpers.exe[2164] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcd00260 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcc80180 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcc800d8 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcc80110 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [F6, FF] .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcc80148 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 3 bytes JMP 000007fffcc801f0 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo + 4 000007feff0f89d4 4 bytes [FD, CC, CC, CC] .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 3 bytes JMP 000007fffcc801b8 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 4 000007feff0fbe44 4 bytes [FD, CC, CC, CC] .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcc80228 .text C:\Windows\WindowsMobile\wmdcBase.exe[2172] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcc80260 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcd00228 .text C:\Program Files\iTunes\iTunesHelper.exe[2196] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcd00260 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000076c3a3e0 7 bytes JMP 000000016fff0228 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000076c43f00 5 bytes JMP 000000016fff0180 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000076c5ffd0 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000076c6f350 5 bytes JMP 000000016fff0110 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000076c99aa0 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000076ca9530 5 bytes JMP 000000016fff0148 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000076cc8850 7 bytes JMP 000000016fff01f0 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2256] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0f89d0 8 bytes JMP 000007fffcd001f0 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff0fbe40 8 bytes JMP 000007fffcd001b8 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe9274a0 11 bytes JMP 000007fffcd00228 .text C:\Windows\system32\taskeng.exe[2416] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe93bf10 7 bytes JMP 000007fffcd00260 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000074de5ea5 5 bytes JMP 00000001729b2970 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2812] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000074e19d0b 5 bytes JMP 00000001729b2900 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\OLE32.dll!CoSetProxyBlanket 0000000074de5ea5 5 bytes JMP 00000001729b2970 .text C:\Program Files (x86)\screenSHU\screenSHU.exe[2892] C:\Windows\syswow64\OLE32.dll!CoCreateInstance 0000000074e19d0b 5 bytes JMP 00000001729b2900 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000074de5ea5 5 bytes JMP 00000001729b2970 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000074e19d0b 5 bytes JMP 00000001729b2900 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074dc1401 2 bytes JMP 750bb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074dc1419 2 bytes JMP 750bb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074dc1431 2 bytes JMP 75138f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074dc144a 2 bytes CALL 7509489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074dc14dd 2 bytes JMP 75138822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074dc14f5 2 bytes JMP 751389f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074dc150d 2 bytes JMP 75138718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074dc1525 2 bytes JMP 75138ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074dc153d 2 bytes JMP 750afca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074dc1555 2 bytes JMP 750b68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074dc156d 2 bytes JMP 75138fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074dc1585 2 bytes JMP 75138b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074dc159d 2 bytes JMP 751386dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074dc15b5 2 bytes JMP 750afd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074dc15cd 2 bytes JMP 750bb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074dc16b2 2 bytes JMP 75138ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074dc16bd 2 bytes JMP 75138671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000074de5ea5 5 bytes JMP 00000001729b2970 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000074e19d0b 5 bytes JMP 00000001729b2900 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074dc1401 2 bytes JMP 750bb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074dc1419 2 bytes JMP 750bb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074dc1431 2 bytes JMP 75138f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074dc144a 2 bytes CALL 7509489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074dc14dd 2 bytes JMP 75138822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074dc14f5 2 bytes JMP 751389f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074dc150d 2 bytes JMP 75138718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074dc1525 2 bytes JMP 75138ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074dc153d 2 bytes JMP 750afca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074dc1555 2 bytes JMP 750b68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074dc156d 2 bytes JMP 75138fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074dc1585 2 bytes JMP 75138b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074dc159d 2 bytes JMP 751386dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074dc15b5 2 bytes JMP 750afd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074dc15cd 2 bytes JMP 750bb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074dc16b2 2 bytes JMP 75138ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074dc16bd 2 bytes JMP 75138671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000074de5ea5 5 bytes JMP 00000001729b2970 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000074e19d0b 5 bytes JMP 00000001729b2900 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1816] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074dc1401 2 bytes JMP 750bb21b C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074dc1419 2 bytes JMP 750bb346 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074dc1431 2 bytes JMP 75138f29 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074dc144a 2 bytes CALL 7509489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074dc14dd 2 bytes JMP 75138822 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074dc14f5 2 bytes JMP 751389f8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074dc150d 2 bytes JMP 75138718 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074dc1525 2 bytes JMP 75138ae2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074dc153d 2 bytes JMP 750afca8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074dc1555 2 bytes JMP 750b68ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074dc156d 2 bytes JMP 75138fe3 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074dc1585 2 bytes JMP 75138b42 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074dc159d 2 bytes JMP 751386dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074dc15b5 2 bytes JMP 750afd41 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074dc15cd 2 bytes JMP 750bb2dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074dc16b2 2 bytes JMP 75138ea4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\syswow64\svchost.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074dc16bd 2 bytes JMP 75138671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Program Files (x86)\Samsung\Easy Settings\sSettings.exe[4156] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 .text C:\Program Files\Samsung\S Agent\CommonAgent.exe[3148] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefcd12db0 5 bytes JMP 000007fffcd00180 .text C:\Program Files\Samsung\S Agent\CommonAgent.exe[3148] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefcd137d0 7 bytes JMP 000007fffcd000d8 .text C:\Program Files\Samsung\S Agent\CommonAgent.exe[3148] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefcd1a410 2 bytes JMP 000007fffcd00110 .text C:\Program Files\Samsung\S Agent\CommonAgent.exe[3148] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3 000007fefcd1a413 2 bytes [FE, FF] .text C:\Program Files\Samsung\S Agent\CommonAgent.exe[3148] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefcd1aec0 6 bytes JMP 000007fffcd00148 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075091efe 7 bytes JMP 00000001729b3990 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075095b9d 7 bytes JMP 00000001729b3fd0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000750a13f9 7 bytes JMP 00000001729b3be0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000750aea45 7 bytes JMP 00000001729b3980 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075138ea4 7 bytes JMP 00000001729b34d0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075138f29 5 bytes JMP 00000001729b3580 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075139281 5 bytes JMP 00000001729b34e0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000074a11d29 5 bytes JMP 00000001729b3490 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000074a11dd7 5 bytes JMP 00000001729b3450 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074a12ab1 5 bytes JMP 00000001729b3590 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000074a12d1d 5 bytes JMP 00000001729b32a0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007662d2b4 5 bytes JMP 00000001729b2ad0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007662d4ee 5 bytes JMP 00000001729b2ae0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076a48a29 5 bytes JMP 00000001729b29b0 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076a54572 5 bytes JMP 00000001729b3220 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076a6e567 5 bytes JMP 00000001729b3290 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000076a907d7 5 bytes JMP 00000001729b2830 .text C:\Users\Donek\Desktop\4ncptqkh.exe[192] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076aa7a5c 5 bytes JMP 00000001729b3210 ---- Threads - GMER 2.1 ---- Thread C:\Windows\syswow64\svchost.exe [2932:1812] 0000000000096a60 Thread C:\Windows\syswow64\svchost.exe [2932:3152] 0000000000092be0 Thread C:\Windows\syswow64\svchost.exe [2932:2560] 00000000000964d0 Thread C:\Windows\syswow64\svchost.exe [2932:2552] 00000000000964d0 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90a4de551491 Reg HKLM\SYSTEM\CurrentControlSet\services\rdyboost\Parameters@ReadyBootPlanAge 1 Reg HKLM\SYSTEM\CurrentControlSet\services\rdyboost\Parameters@LastBootPlanUserTime ?N?, ?lip ?26 ?15, 12:55:47?????????????A?????????????????????? Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90a4de551491 (not active ControlSet) ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----