| peter4711 | 09.10.2013 08:12 |
GMER Teil 13: Code:
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1 00000000777e1e31 3 bytes [B8, 39, E0]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 5 00000000777e1e35 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1 0000000077815011 11 bytes [B8, 79, 75, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1 0000000077815031 11 bytes [B8, F9, 71, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\kernel32.dll!ReadConsoleW 000000007782a560 12 bytes [48, B8, 79, 7C, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\kernel32.dll!ReadConsoleA 000000007782a670 12 bytes [48, B8, F9, 78, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1 000007fefda01861 11 bytes [B8, 39, 4D, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1 000007fefda02db1 11 bytes [B8, 79, C2, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1 000007fefda03461 3 bytes [B8, 39, C4]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 5 000007fefda03465 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda08ef0 12 bytes [48, B8, B9, C0, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!CreateMutexW 000007fefda094c0 12 bytes [48, B8, 79, 4B, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1 000007fefda0bfd1 3 bytes [B8, F9, BE]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 5 000007fefda0bfd5 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1 000007fefda12af1 11 bytes [B8, B9, 49, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory 000007fefda34350 12 bytes [48, B8, 79, 3D, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1 000007fefda42871 8 bytes [B8, 39, 23, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10 000007fefda4287a 2 bytes [50, C3]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1 000007fefda428b1 11 bytes [B8, B9, 3B, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 65 000007feffb30761 3 bytes [B8, 79, F3]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 69 000007feffb30765 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007feffb33b44 12 bytes [48, B8, 79, 67, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007feffb4b704 12 bytes [48, B8, B9, 65, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW 000007feffb4b870 12 bytes [48, B8, 39, 5B, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA 000007feffb4b8dc 12 bytes [48, B8, 79, 59, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1 000007feffaf642d 11 bytes [B8, F9, 55, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW 000007feffaf6484 12 bytes [48, B8, B9, 50, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1 000007feffaf6519 11 bytes [B8, F9, 5C, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA 000007feffaf6c34 12 bytes [48, B8, F9, 4E, 08, 76, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1 000007feffaf7ab5 11 bytes [B8, B9, 57, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1 000007feffaf8b01 11 bytes [B8, 79, 52, 08, 76, 00, 00, ...]
.text C:\Program Files\iPod\bin\iPodService.exe[5988] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1 000007feffaf8c39 11 bytes [B8, 39, 54, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1 00000000779192d1 5 bytes [B8, F9, 63, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7 00000000779192d7 5 bytes [00, 00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077931330 6 bytes [48, B8, 79, EC, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8 0000000077931338 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000779313a0 6 bytes [48, B8, 79, D0, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8 00000000779313a8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077931470 6 bytes [48, B8, 39, BD, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8 0000000077931478 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077931510 6 bytes [48, B8, F9, 32, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000077931518 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077931530 6 bytes [48, B8, 39, 1C, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000077931538 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077931550 6 bytes [48, B8, F9, 1D, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000077931558 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077931570 6 bytes [48, B8, 79, BB, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8 0000000077931578 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077931620 6 bytes [48, B8, F9, E8, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8 0000000077931628 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077931650 6 bytes [48, B8, 79, 2F, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8 0000000077931658 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077931670 6 bytes [48, B8, 79, 36, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8 0000000077931678 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077931700 6 bytes [48, B8, B9, 34, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8 0000000077931708 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077931750 6 bytes [48, B8, 39, EE, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8 0000000077931758 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077931780 6 bytes [48, B8, 39, 2A, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8 0000000077931788 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077931790 6 bytes [48, B8, B9, 26, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8 0000000077931798 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077931800 6 bytes [48, B8, B9, EA, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000077931808 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779318b0 6 bytes [48, B8, B9, F1, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779318b8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000077931c80 6 bytes [48, B8, 39, E7, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8 0000000077931c88 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess 0000000077931cd0 6 bytes [48, B8, 79, 28, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8 0000000077931cd8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077931d30 6 bytes [48, B8, F9, 24, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8 0000000077931d38 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000779320a0 6 bytes [48, B8, 39, D2, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8 00000000779320a8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError 00000000779325e0 6 bytes [48, B8, 39, 7E, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8 00000000779325e8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000779327e0 6 bytes [48, B8, 39, 31, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8 00000000779327e8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000779329a0 6 bytes [48, B8, F9, D3, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8 00000000779329a8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000077932aa0 6 bytes [48, B8, F9, EF, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8 0000000077932aa8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000077932b80 6 bytes [48, B8, F9, E1, 08, 76]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8 0000000077932b88 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1 00000000779a3201 3 bytes [B8, F9, 7F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 5 00000000779a3205 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!Process32NextW + 1 00000000777c20f1 11 bytes [B8, B9, CE, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot 00000000777c21e0 12 bytes [48, B8, F9, 39, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 00000000777de750 12 bytes [48, B8, B9, 2D, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1 00000000777e1e31 3 bytes [B8, 39, E0]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 5 00000000777e1e35 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1 0000000077815011 11 bytes [B8, 79, 75, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1 0000000077815031 11 bytes [B8, F9, 71, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!ReadConsoleW 000000007782a560 12 bytes [48, B8, 79, 7C, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\kernel32.dll!ReadConsoleA 000000007782a670 12 bytes [48, B8, F9, 78, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1 000007fefda01861 11 bytes [B8, 39, 4D, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1 000007fefda02db1 11 bytes [B8, 79, C2, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1 000007fefda03461 3 bytes [B8, 39, C4]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 5 000007fefda03465 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda08ef0 12 bytes [48, B8, B9, C0, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!CreateMutexW 000007fefda094c0 12 bytes [48, B8, 79, 4B, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1 000007fefda0bfd1 3 bytes [B8, F9, BE]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 5 000007fefda0bfd5 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1 000007fefda12af1 11 bytes [B8, B9, 49, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory 000007fefda34350 12 bytes [48, B8, 79, 3D, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1 000007fefda42871 8 bytes [B8, 39, 23, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10 000007fefda4287a 2 bytes [50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1 000007fefda428b1 11 bytes [B8, B9, 3B, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 65 000007feffb30761 3 bytes [B8, 79, F3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 69 000007feffb30765 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007feffb33b44 12 bytes [48, B8, 79, 67, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007feffb4b704 12 bytes [48, B8, B9, 65, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW 000007feffb4b870 12 bytes [48, B8, 39, 5B, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA 000007feffb4b8dc 12 bytes [48, B8, 79, 59, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1 000007feffaf642d 11 bytes [B8, F9, 55, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW 000007feffaf6484 12 bytes [48, B8, B9, 50, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1 000007feffaf6519 11 bytes [B8, F9, 5C, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA 000007feffaf6c34 12 bytes [48, B8, F9, 4E, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1 000007feffaf7ab5 11 bytes [B8, B9, 57, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1 000007feffaf8b01 11 bytes [B8, 79, 52, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1 000007feffaf8c39 11 bytes [B8, 39, 54, 08, 76, 00, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW 000007fefdb2a480 12 bytes [48, B8, 79, 60, 08, 76, 00, ...]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[5560] C:\Windows\system32\urlmon.dll!URLDownloadToFileW + 1 000007fefdb2b3ed 11 bytes [B8, B9, 5E, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1 00000000779192d1 5 bytes [B8, F9, 63, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7 00000000779192d7 5 bytes [00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077931330 6 bytes [48, B8, 39, E7, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8 0000000077931338 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000779313a0 6 bytes [48, B8, 79, D0, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8 00000000779313a8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077931470 6 bytes [48, B8, 39, BD, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8 0000000077931478 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077931510 6 bytes [48, B8, F9, 32, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000077931518 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077931530 6 bytes [48, B8, 39, 1C, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000077931538 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077931550 6 bytes [48, B8, F9, 1D, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000077931558 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077931570 6 bytes [48, B8, 79, BB, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8 0000000077931578 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077931620 6 bytes [48, B8, B9, E3, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8 0000000077931628 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077931650 6 bytes [48, B8, 79, 2F, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8 0000000077931658 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077931670 6 bytes [48, B8, 79, 36, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8 0000000077931678 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077931700 6 bytes [48, B8, B9, 34, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8 0000000077931708 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077931750 6 bytes [48, B8, F9, E8, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8 0000000077931758 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077931780 6 bytes [48, B8, 39, 2A, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8 0000000077931788 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077931790 6 bytes [48, B8, B9, 26, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8 0000000077931798 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077931800 6 bytes [48, B8, 79, E5, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000077931808 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779318b0 6 bytes [48, B8, 79, EC, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779318b8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000077931c80 6 bytes [48, B8, F9, E1, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8 0000000077931c88 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess 0000000077931cd0 6 bytes [48, B8, 79, 28, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8 0000000077931cd8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077931d30 6 bytes [48, B8, F9, 24, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8 0000000077931d38 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000779320a0 6 bytes [48, B8, 39, D2, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8 00000000779320a8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError 00000000779325e0 6 bytes [48, B8, 39, 7E, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8 00000000779325e8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000779327e0 6 bytes [48, B8, 39, 31, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8 00000000779327e8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000779329a0 6 bytes [48, B8, F9, D3, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8 00000000779329a8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000077932aa0 6 bytes [48, B8, B9, EA, 08, 76]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8 0000000077932aa8 4 bytes [00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1 00000000779a3201 3 bytes [B8, F9, 7F]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 5 00000000779a3205 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!Process32NextW + 1 00000000777c20f1 11 bytes [B8, B9, CE, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot 00000000777c21e0 12 bytes [48, B8, F9, 39, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 00000000777de750 12 bytes [48, B8, B9, 2D, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1 00000000777e1e31 3 bytes [B8, 39, E0]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 5 00000000777e1e35 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1 0000000077815011 11 bytes [B8, 79, 75, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1 0000000077815031 11 bytes [B8, F9, 71, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!ReadConsoleW 000000007782a560 12 bytes [48, B8, 79, 7C, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\kernel32.dll!ReadConsoleA 000000007782a670 12 bytes [48, B8, F9, 78, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1 000007fefda01861 11 bytes [B8, 39, 4D, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1 000007fefda02db1 11 bytes [B8, 79, C2, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1 000007fefda03461 3 bytes [B8, 39, C4]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 5 000007fefda03465 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda08ef0 12 bytes [48, B8, B9, C0, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!CreateMutexW 000007fefda094c0 12 bytes [48, B8, 79, 4B, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1 000007fefda0bfd1 3 bytes [B8, F9, BE]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 5 000007fefda0bfd5 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1 000007fefda12af1 11 bytes [B8, B9, 49, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory 000007fefda34350 12 bytes [48, B8, 79, 3D, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1 000007fefda42871 8 bytes [B8, 39, 23, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10 000007fefda4287a 2 bytes [50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1 000007fefda428b1 11 bytes [B8, B9, 3B, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!WSASend + 1 000007feff8713b1 3 bytes [B8, B9, B9]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!WSASend + 5 000007feff8713b5 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!closesocket 000007feff8718e0 12 bytes [48, B8, F9, B7, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!WSASocketW + 1 000007feff871bd1 11 bytes [B8, 39, B6, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!WSARecv + 1 000007feff872201 3 bytes [B8, B9, DC]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!WSARecv + 5 000007feff872205 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!GetAddrInfoW 000007feff8723c0 12 bytes [48, B8, 39, A1, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!connect 000007feff8745c0 12 bytes [48, B8, 39, 62, 08, 76, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!send + 1 000007feff878001 11 bytes [B8, 79, B4, 08, 76, 00, 00, ...]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!gethostbyname 000007feff878df0 7 bytes [48, B8, F9, A2, 08, 76, 00]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!gethostbyname + 9 000007feff878df9 3 bytes [00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!socket + 1 000007feff87de91 3 bytes [B8, B9, D5]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!socket + 5 000007feff87de95 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!recv + 1 000007feff87df41 3 bytes [B8, F9, DA]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!recv + 5 000007feff87df45 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\System32\svchost.exe[5944] C:\Windows\system32\WS2_32.dll!WSAConnect + 1 000007feff89e0f1 11 bytes [B8, 39, D9, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1 00000000779192d1 5 bytes [B8, F9, 63, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7 00000000779192d7 5 bytes [00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077931330 6 bytes [48, B8, 79, EC, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8 0000000077931338 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000779313a0 6 bytes [48, B8, 79, D0, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8 00000000779313a8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077931470 6 bytes [48, B8, 39, BD, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8 0000000077931478 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077931510 6 bytes [48, B8, F9, 32, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000077931518 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077931530 6 bytes [48, B8, 39, 1C, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000077931538 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077931550 6 bytes [48, B8, F9, 1D, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000077931558 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077931570 6 bytes [48, B8, 79, BB, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8 0000000077931578 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077931620 6 bytes [48, B8, F9, E8, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8 0000000077931628 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077931650 6 bytes [48, B8, 79, 2F, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8 0000000077931658 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077931670 6 bytes [48, B8, 79, 36, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8 0000000077931678 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077931700 6 bytes [48, B8, B9, 34, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8 0000000077931708 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077931750 6 bytes [48, B8, 39, EE, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8 0000000077931758 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077931780 6 bytes [48, B8, 39, 2A, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8 0000000077931788 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077931790 6 bytes [48, B8, B9, 26, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8 0000000077931798 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077931800 6 bytes [48, B8, B9, EA, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000077931808 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779318b0 6 bytes [48, B8, B9, F1, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779318b8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000077931c80 6 bytes [48, B8, 39, E7, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8 0000000077931c88 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess 0000000077931cd0 6 bytes [48, B8, 79, 28, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8 0000000077931cd8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077931d30 6 bytes [48, B8, F9, 24, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8 0000000077931d38 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000779320a0 6 bytes [48, B8, 39, D2, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8 00000000779320a8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError 00000000779325e0 6 bytes [48, B8, 39, 7E, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8 00000000779325e8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000779327e0 6 bytes [48, B8, 39, 31, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8 00000000779327e8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000779329a0 6 bytes [48, B8, F9, D3, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8 00000000779329a8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000077932aa0 6 bytes [48, B8, F9, EF, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8 0000000077932aa8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000077932b80 6 bytes [48, B8, F9, E1, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8 0000000077932b88 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1 00000000779a3201 3 bytes [B8, F9, 7F]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 5 00000000779a3205 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!Process32NextW + 1 00000000777c20f1 11 bytes [B8, B9, CE, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot 00000000777c21e0 12 bytes [48, B8, F9, 39, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 00000000777de750 12 bytes [48, B8, B9, 2D, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1 00000000777e1e31 3 bytes [B8, 39, E0]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 5 00000000777e1e35 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1 0000000077815011 11 bytes [B8, 79, 75, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1 0000000077815031 11 bytes [B8, F9, 71, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!ReadConsoleW 000000007782a560 12 bytes [48, B8, 79, 7C, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\kernel32.dll!ReadConsoleA 000000007782a670 12 bytes [48, B8, F9, 78, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1 000007fefda01861 11 bytes [B8, 39, 4D, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1 000007fefda02db1 11 bytes [B8, 79, C2, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1 000007fefda03461 3 bytes [B8, 39, C4]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 5 000007fefda03465 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda08ef0 12 bytes [48, B8, B9, C0, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!CreateMutexW 000007fefda094c0 12 bytes [48, B8, 79, 4B, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1 000007fefda0bfd1 3 bytes [B8, F9, BE]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 5 000007fefda0bfd5 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1 000007fefda12af1 11 bytes [B8, B9, 49, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory 000007fefda34350 12 bytes [48, B8, 79, 3D, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1 000007fefda42871 8 bytes [B8, 39, 23, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10 000007fefda4287a 2 bytes [50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1 000007fefda428b1 11 bytes [B8, B9, 3B, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!CreateWindowExA 00000000776ca2e0 12 bytes [48, B8, 79, A6, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!PostMessageA + 1 00000000776ca405 3 bytes [B8, B9, E3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!PostMessageA + 5 00000000776ca409 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!CallNextHookEx + 1 00000000776cbae1 11 bytes [B8, B9, 81, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowW + 1 00000000776cd265 7 bytes [B8, 79, C9, 08, 76, 00, 00]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowW + 9 00000000776cd26d 3 bytes [00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 00000000776cd440 6 bytes [48, B8, 79, 83, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx + 8 00000000776cd448 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowsHookExW + 1 00000000776cf875 7 bytes [B8, 79, 21, 08, 76, 00, 00]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowsHookExW + 9 00000000776cf87d 3 bytes [00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!CreateWindowExW 00000000776d0810 12 bytes [48, B8, B9, A4, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!ShowWindow 00000000776d1930 6 bytes [48, B8, 39, A8, 08, 76]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!ShowWindow + 8 00000000776d1938 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!PeekMessageA + 1 00000000776d3a19 3 bytes [B8, B9, 6C]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!PeekMessageA + 5 00000000776d3a1d 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!GetMessageA + 1 00000000776d6111 11 bytes [B8, 39, 69, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowTextW + 1 00000000776d7055 3 bytes [B8, B9, B2]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowTextW + 5 00000000776d7059 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!PostMessageW + 1 00000000776d76e5 11 bytes [B8, 79, E5, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!PeekMessageW + 1 00000000776d8fd1 3 bytes [B8, 79, 6E]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!PeekMessageW + 5 00000000776d8fd5 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!GetMessageW 00000000776d9e74 12 bytes [48, B8, F9, 6A, 08, 76, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!UserClientDllInitialize + 1 00000000776da2c9 3 bytes [B8, 79, F3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!UserClientDllInitialize + 5 00000000776da2cd 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!DialogBoxIndirectParamAorW + 1 00000000776e4efd 3 bytes [B8, B9, AB]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!DialogBoxIndirectParamAorW + 5 00000000776e4f01 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!CreateDialogIndirectParamAorW + 1 00000000776e7469 3 bytes [B8, F9, A9]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!CreateDialogIndirectParamAorW + 5 00000000776e746d 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowA + 1 00000000776e8271 7 bytes [B8, F9, C5, 08, 76, 00, 00]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowA + 9 00000000776e8279 3 bytes [00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowsHookExA + 1 00000000776e8c21 8 bytes [B8, B9, 1F, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowsHookExA + 10 00000000776e8c2a 2 bytes [50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowExW + 1 00000000776e8d21 7 bytes [B8, 39, CB, 08, 76, 00, 00]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowExW + 9 00000000776e8d29 3 bytes [00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!MessageBoxExA + 1 0000000077731371 11 bytes [B8, 79, AD, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!MessageBoxExW + 1 0000000077731395 11 bytes [B8, 39, AF, 08, 76, 00, 00, ...]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowTextA + 1 000000007773d379 3 bytes [B8, F9, B0]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!SetWindowTextA + 5 000000007773d37d 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowExA + 1 000000007773dae1 7 bytes [B8, B9, C7, 08, 76, 00, 00]
.text C:\Windows\system32\taskeng.exe[5460] C:\Windows\system32\USER32.dll!FindWindowExA + 9 000000007773dae9 3 bytes [00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1 00000000779192d1 5 bytes [B8, F9, 63, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7 00000000779192d7 5 bytes [00, 00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077931330 6 bytes [48, B8, 79, EC, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8 0000000077931338 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000779313a0 6 bytes [48, B8, 79, D0, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8 00000000779313a8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077931470 6 bytes [48, B8, 39, BD, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8 0000000077931478 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077931510 6 bytes [48, B8, F9, 32, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000077931518 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077931530 6 bytes [48, B8, 39, 1C, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000077931538 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077931550 6 bytes [48, B8, F9, 1D, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000077931558 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077931570 6 bytes [48, B8, 79, BB, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8 0000000077931578 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077931620 6 bytes [48, B8, F9, E8, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8 0000000077931628 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077931650 6 bytes [48, B8, 79, 2F, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8 0000000077931658 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077931670 6 bytes [48, B8, 79, 36, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8 0000000077931678 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077931700 6 bytes [48, B8, B9, 34, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8 0000000077931708 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077931750 6 bytes [48, B8, 39, EE, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8 0000000077931758 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077931780 6 bytes [48, B8, 39, 2A, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8 0000000077931788 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077931790 6 bytes [48, B8, B9, 26, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8 0000000077931798 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077931800 6 bytes [48, B8, B9, EA, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000077931808 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779318b0 6 bytes [48, B8, B9, F1, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779318b8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000077931c80 6 bytes [48, B8, 39, E7, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8 0000000077931c88 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess 0000000077931cd0 6 bytes [48, B8, 79, 28, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8 0000000077931cd8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077931d30 6 bytes [48, B8, F9, 24, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8 0000000077931d38 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000779320a0 6 bytes [48, B8, 39, D2, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8 00000000779320a8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError 00000000779325e0 6 bytes [48, B8, 39, 7E, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8 00000000779325e8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000779327e0 6 bytes [48, B8, 39, 31, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8 00000000779327e8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000779329a0 6 bytes [48, B8, F9, D3, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8 00000000779329a8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000077932aa0 6 bytes [48, B8, F9, EF, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8 0000000077932aa8 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000077932b80 6 bytes [48, B8, F9, E1, 08, 76]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8 0000000077932b88 4 bytes [00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1 00000000779a3201 3 bytes [B8, F9, 7F]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 5 00000000779a3205 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!Process32NextW + 1 00000000777c20f1 11 bytes [B8, B9, CE, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot 00000000777c21e0 12 bytes [48, B8, F9, 39, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 00000000777de750 12 bytes [48, B8, B9, 2D, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1 00000000777e1e31 3 bytes [B8, 39, E0]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 5 00000000777e1e35 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1 0000000077815011 11 bytes [B8, 79, 75, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1 0000000077815031 11 bytes [B8, F9, 71, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!ReadConsoleW 000000007782a560 12 bytes [48, B8, 79, 7C, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\kernel32.dll!ReadConsoleA 000000007782a670 12 bytes [48, B8, F9, 78, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1 000007fefda01861 11 bytes [B8, 39, 4D, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1 000007fefda02db1 11 bytes [B8, 79, C2, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1 000007fefda03461 3 bytes [B8, 39, C4]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 5 000007fefda03465 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda08ef0 12 bytes [48, B8, B9, C0, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!CreateMutexW 000007fefda094c0 12 bytes [48, B8, 79, 4B, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1 000007fefda0bfd1 3 bytes [B8, F9, BE]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 5 000007fefda0bfd5 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1 000007fefda12af1 11 bytes [B8, B9, 49, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory 000007fefda34350 12 bytes [48, B8, 79, 3D, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1 000007fefda42871 8 bytes [B8, 39, 23, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10 000007fefda4287a 2 bytes [50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1 000007fefda428b1 11 bytes [B8, B9, 3B, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 65 000007feffb30761 3 bytes [B8, 79, F3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 69 000007feffb30765 7 bytes [76, 00, 00, 00, 00, 50, C3]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007feffb33b44 12 bytes [48, B8, 79, 67, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007feffb4b704 12 bytes [48, B8, B9, 65, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW 000007feffb4b870 12 bytes [48, B8, 39, 5B, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA 000007feffb4b8dc 12 bytes [48, B8, 79, 59, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1 000007feffaf642d 11 bytes [B8, F9, 55, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW 000007feffaf6484 12 bytes [48, B8, B9, 50, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1 000007feffaf6519 11 bytes [B8, F9, 5C, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA 000007feffaf6c34 12 bytes [48, B8, F9, 4E, 08, 76, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1 000007feffaf7ab5 11 bytes [B8, B9, 57, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1 000007feffaf8b01 11 bytes [B8, 79, 52, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1 000007feffaf8c39 11 bytes [B8, 39, 54, 08, 76, 00, 00, ...]
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[6612] C:\Windows\system32\SHELL32.dll!Shell_NotifyIconW + 1 000007fefe6fdcb1 11 bytes [B8, 39, 85, 08, 76, 00, 00, ...]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1 00000000779192d1 5 bytes [B8, F9, 63, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7 00000000779192d7 5 bytes [00, 00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077931330 6 bytes [48, B8, 79, EC, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8 0000000077931338 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000779313a0 6 bytes [48, B8, 79, D0, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8 00000000779313a8 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077931470 6 bytes [48, B8, 39, BD, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8 0000000077931478 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077931510 6 bytes [48, B8, F9, 32, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000077931518 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077931530 6 bytes [48, B8, 39, 1C, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000077931538 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077931550 6 bytes [48, B8, F9, 1D, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000077931558 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077931570 6 bytes [48, B8, 79, BB, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8 0000000077931578 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077931620 6 bytes [48, B8, F9, E8, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8 0000000077931628 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077931650 6 bytes [48, B8, 79, 2F, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8 0000000077931658 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077931670 6 bytes [48, B8, 79, 36, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8 0000000077931678 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077931700 6 bytes [48, B8, B9, 34, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8 0000000077931708 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077931750 6 bytes [48, B8, 39, EE, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8 0000000077931758 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077931780 6 bytes [48, B8, 39, 2A, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8 0000000077931788 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077931790 6 bytes [48, B8, B9, 26, 08, 76]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8 0000000077931798 4 bytes [00, 00, 50, C3]
.text C:\Windows\system32\DllHost.exe[6764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077931800 6 bytes [48, B8, B9, EA, 08, 76]
|
WARNUNG an die MITLESER: