GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-09-05 18:25:10 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3 TOSHIBA_Q300 rev.SAFM11.2 111,79GB Running: 4df1xwxd.exe; Driver: C:\Users\DINO\AppData\Local\Temp\kxtdapob.sys ---- Kernel code sections - GMER 2.2 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000135200 7 bytes [C0, 73, F3, FF, 41, 83, F0] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000135208 3 bytes [C0, 06, 02] ---- User code sections - GMER 2.2 ---- .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077e70078 5 bytes JMP 0000000069921986 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[788] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinSaber\WinSaber.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077442ab1 5 bytes JMP 00000000010d31c2 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Paseczek\Paseczek.exe[4088] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4192] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[4640] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075a51401 2 bytes JMP 7641b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075a51419 2 bytes JMP 7641b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075a51431 2 bytes JMP 76498f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075a5144a 2 bytes CALL 763f4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075a514dd 2 bytes JMP 76498832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075a514f5 2 bytes JMP 76498a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075a5150d 2 bytes JMP 76498728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075a51525 2 bytes JMP 76498af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075a5153d 2 bytes JMP 7640fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075a51555 2 bytes JMP 764168df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075a5156d 2 bytes JMP 76498ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075a51585 2 bytes JMP 76498b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075a5159d 2 bytes JMP 764986ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075a515b5 2 bytes JMP 7640fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075a515cd 2 bytes JMP 7641b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075a516b2 2 bytes JMP 76498eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe[988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075a516bd 2 bytes JMP 76498681 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegCreateKeyExW] [7fef8c9b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegDeleteValueW] [7fef8c9bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegOpenKeyExW] [7fef8c9b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegSetValueExW] [7fef8c9bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msiexec.exe[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CopyFileW] [7fef8c9a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!DeleteFileW] [7fef8c9a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegOpenKeyExW] [7fef8c9b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegCreateKeyExW] [7fef8c9b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegSetValueExW] [7fef8c9bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CopyFileW] [7fef8c9a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!DeleteFileW] [7fef8c9a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!SetFileSecurityW] [7fef8c9bea8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegCreateKeyExW] [7fef8c9b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExA] [7fef8c9bc04] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegOpenKeyExW] [7fef8c9b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteValueW] [7fef8c9bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteKeyW] [7fef8c9d0cc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExW] [7fef8c9bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileExW] [7fef8c9a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[KERNEL32.dll!SetFileAttributesW] [7fef8c9add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileW] [7fef8c9a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[KERNEL32.dll!DeleteFileW] [7fef8c9a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\msi.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!DeleteFileW] [7fef8c9a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesW] [7fef8c9add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesA] [7fef8c9ad74] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileA] [7fef8c9a4d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!DeleteFileW] [7fef8c9a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!MoveFileExW] [7fef8c9a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!SetFileAttributesW] [7fef8c9add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CopyFileW] [7fef8c9a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileExW] [7fef8c9a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!CopyFileW] [7fef8c9a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileW] [7fef8c9a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\sfc_os.DLL[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!PrivCopyFileExW] [7fef8c9acfc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!MoveFileExW] [7fef8c9a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!OpenFile] [7fef8c9aa88] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\COMCTL32.DLL[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\COMCTL32.DLL[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegDeleteValueW] [7fef8c9bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegCreateKeyExW] [7fef8c9b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegSetValueExW] [7fef8c9bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegOpenKeyExW] [7fef8c9b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileExW] [7fef8c9a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!SetFileAttributesW] [7fef8c9add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileW] [7fef8c9a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!DeleteFileW] [7fef8c9a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!_lwrite] [7fef8c9ac14] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileA] [7fef8c9a4d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!DeleteFileW] [7fef8c9a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!CreateFileW] [7fef8c9a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegCreateKeyExA] [7fef8c9b5d4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fefda54230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!MoveFileExW] [7fef8c9a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[2020] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegSetValueExA] [7fef8c9bc04] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord] [7fef84f741c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet] [7fef84f5f10] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession] [7fef84f5674] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession] [7fef84f5e2c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload] [7fef84f7f48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion] [7fef84f6a38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId] [7fef84f6ee8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId] [7fef84f7b58] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId] [7fef84f7ea0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId] [7fef84f78b0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession] [7fef84f4fb4] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId] [7fef84f5d38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2276] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString] [7fef84f7584] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll ---- EOF - GMER 2.2 ----