Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

multiple and frequent crashes forcing PC to reboot [Solved]

Started by OGdexter , Aug 10 2014 07:25 PM

  • This topic is locked This topic is locked

#16
OGdexter
Posted 17 August 2014 - 08:53 AM

OGdexter

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 106 posts
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                                                              0000000076ee1d8c 5 bytes JMP 0000000173b76dd1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                                                                      0000000076ee1ee8 5 bytes JMP 0000000173b769a9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\SysWOW64\ntdll.dll!RtlQueryPerformanceCounter                                                                                        0000000076ef88c4 5 bytes JMP 0000000173b71ab1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                                                                      0000000076f20d3b 5 bytes JMP 0000000173b72009
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\SysWOW64\ntdll.dll!RtlReportException                                                                                                0000000076f6860f 5 bytes JMP 0000000173b74b61
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                                                                        0000000076f6e8ab 5 bytes JMP 0000000173b71f71
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                                                                0000000076050e00 5 bytes JMP 0000000173b71da9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                                 0000000076051072 5 bytes JMP 0000000173b72a21
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                                                   000000007605499f 5 bytes JMP 0000000173b725f9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                         0000000076063bbb 5 bytes JMP 0000000173b73011
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                                                                       0000000076077327 5 bytes JMP 0000000173b72729
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!Process32NextW                                                                                                 00000000760788da 5 bytes JMP 0000000173b76451
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                                        00000000760d2ff1 5 bytes JMP 0000000173b728f1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                                                              00000000760f748b 5 bytes JMP 0000000173b746a1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                                                              00000000760f74ae 5 bytes JMP 0000000173b747d1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                                                                   00000000760f7859 5 bytes JMP 0000000173b74901
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                                                                   00000000760f78d2 5 bytes JMP 0000000173b74a31
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!GetSystemTimeAsFileTime                                                                                      0000000075b28f8d 5 bytes JMP 0000000173b71a19
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!CloseHandle                                                                                                  0000000075b2c436 5 bytes JMP 0000000173b73b59
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!WriteProcessMemory                                                                                           0000000075b2eca6 5 bytes JMP 0000000173b73601
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!ExitProcess                                                                                                  0000000075b2f206 5 bytes JMP 0000000173b72399
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!GetStartupInfoW                                                                                              0000000075b2fa89 5 bytes JMP 0000000173b71e41
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!CreateMutexW                                                                                                 0000000075b31358 5 bytes JMP 0000000173b73ac1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!OpenMutexW                                                                                                   0000000075b3137f 5 bytes JMP 0000000173b73a29
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                             0000000075b31d29 5 bytes JMP 0000000173b71981
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!GetProcAddress                                                                                               0000000075b31e15 5 bytes JMP 0000000173b724c9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                               0000000075b32ab1 5 bytes JMP 0000000173b76029
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExA                                                                                               0000000075b32cd9 5 bytes JMP 0000000173b75f91
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                  0000000075b32d17 5 bytes JMP 0000000173b760c1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleA                                                                                             0000000075b32e7a 5 bytes JMP 0000000173b718e9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!SleepEx                                                                                                      0000000075b33b70 5 bytes JMP 0000000173b72269
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!Sleep                                                                                                        0000000075b34496 5 bytes JMP 0000000173b72431
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!CreateThread                                                                                                 0000000075b34608 5 bytes JMP 0000000173b73569
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!CreateRemoteThread                                                                                           0000000075b34631 5 bytes JMP 0000000173b72c81
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\KERNELBASE.dll!CreateFileA                                                                                                  0000000075b3c734 5 bytes JMP 0000000173b727c1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\msvcrt.dll!_lock + 41                                                                                                       00000000769ba472 5 bytes JMP 0000000173b76e69
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\msvcrt.dll!__p__fmode                                                                                                       00000000769c27ce 5 bytes JMP 0000000173b71be1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\msvcrt.dll!__p__environ                                                                                                     00000000769ce6cf 5 bytes JMP 0000000173b71b49
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!GetMessageW                                                                                                      0000000075bc78e2 5 bytes JMP 0000000173b74441
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!GetMessageA                                                                                                      0000000075bc7bd3 5 bytes JMP 0000000173b743a9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                  0000000075bc8a29 5 bytes JMP 0000000173b757d9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!FindWindowW                                                                                                      0000000075bc98fd 5 bytes JMP 0000000173b76289
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!UserClientDllInitialize                                                                                          0000000075bcb6ed 5 bytes JMP 0000000173b76f01
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                                                  0000000075bcd22e 5 bytes JMP 0000000173b75871
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                                                  0000000075bcee09 5 bytes JMP 0000000173b734d1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!FindWindowA                                                                                                      0000000075bcffe6 5 bytes JMP 0000000173b76159
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!FindWindowExA                                                                                                    0000000075bd00d9 5 bytes JMP 0000000173b761f1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                                                                     0000000075bd05ba 5 bytes JMP 0000000173b74571
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!ShowWindow                                                                                                       0000000075bd0dfb 5 bytes JMP 0000000173b75909
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                     0000000075bd12a5 5 bytes JMP 0000000173b76ad9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!SetWindowTextW                                                                                                   0000000075bd20ec 5 bytes JMP 0000000173b75c99
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                     0000000075bd3baa 5 bytes JMP 0000000173b76a41
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                                                                     0000000075bd5f74 5 bytes JMP 0000000173b744d9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!CallNextHookEx                                                                                                   0000000075bd6285 5 bytes JMP 0000000173b74bf9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                                                0000000075bd7603 5 bytes JMP 0000000173b72be9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!SetWindowTextA                                                                                                   0000000075bd7aee 5 bytes JMP 0000000173b75c01
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                                                0000000075bd835c 5 bytes JMP 0000000173b72b51
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamAorW                                                                                       0000000075bece54 5 bytes JMP 0000000173b75a39
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                                              0000000075bef52b 5 bytes JMP 0000000173b74c91
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!FindWindowExW                                                                                                    0000000075bef588 5 bytes JMP 0000000173b76321
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamAorW                                                                                    0000000075bf10a0 5 bytes JMP 0000000173b759a1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!MessageBoxExA                                                                                                    0000000075c1fcd6 5 bytes JMP 0000000173b75ad1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\USER32.dll!MessageBoxExW                                                                                                    0000000075c1fcfa 5 bytes JMP 0000000173b75b69
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW                                                                                                   00000000762bc9ec 3 bytes JMP 0000000173b73c89
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW + 4                                                                                               00000000762bc9f0 1 byte [FD]
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA                                                                                                   00000000762c2b70 3 bytes JMP 0000000173b73bf1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA + 4                                                                                               00000000762c2b74 1 byte [FD]
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle                                                                                             00000000762c361c 3 bytes JMP 0000000173b740b1
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle + 4                                                                                         00000000762c3620 1 byte [FD]
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 222                                                                                            00000000762c4965 3 bytes JMP 0000000173b76f99
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 226                                                                                            00000000762c4969 1 byte [FD]
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                 00000000762d70c4 5 bytes JMP 0000000173b74311
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!ControlService                                                                                                 00000000762d70dc 5 bytes JMP 0000000173b73e51
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!DeleteService                                                                                                  00000000762d70f4 5 bytes JMP 0000000173b73ee9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA                                                                                           00000000762f31f4 5 bytes JMP 0000000173b73f81
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW                                                                                           00000000762f3204 5 bytes JMP 0000000173b74019
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExA                                                                                              00000000762f3214 5 bytes JMP 0000000173b73d21
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExW                                                                                              00000000762f3224 5 bytes JMP 0000000173b73db9
.text     C:\Program Files (x86)\Canon\CAL\CALMAIN.exe[2328] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                 00000000762f3264 5 bytes JMP 0000000173b74279
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                  000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                  000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                               000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                   000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                     000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                               000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                   000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                               000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                           000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                          000007fefcd1287a 2 bytes [50, C3]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                 000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                  000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                        000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                              000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                        000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                   000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                               000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2388] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                               000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                                                          0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                                    0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                      0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                                         0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                                                       0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                                                       0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                                                                0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                                                                0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                                           000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                                           000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                                        000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                            000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                              000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                                        000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                            000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                        000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                                    000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                                   000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                          000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                           000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                                 000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                       000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                                 000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                            000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                        000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                        000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!WSASend + 1                                                                                                                   000007fefdac13b1 11 bytes [B8, F9, BE, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!closesocket                                                                                                                   000007fefdac18e0 12 bytes [48, B8, 39, BD, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!WSASocketW + 1                                                                                                                000007fefdac1bd1 11 bytes [B8, 79, BB, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!WSARecv + 1                                                                                                                   000007fefdac2201 11 bytes [B8, F9, E1, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!GetAddrInfoW                                                                                                                  000007fefdac23c0 12 bytes [48, B8, 79, A6, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!connect                                                                                                                       000007fefdac45c0 12 bytes [48, B8, 79, 67, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!send + 1                                                                                                                      000007fefdac8001 11 bytes [B8, B9, B9, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!gethostbyname                                                                                                                 000007fefdac8df0 7 bytes [48, B8, 39, A8, 60, 75, 00]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!gethostbyname + 9                                                                                                             000007fefdac8df9 3 bytes [00, 50, C3]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!socket + 1                                                                                                                    000007fefdacde91 11 bytes [B8, F9, DA, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!recv + 1                                                                                                                      000007fefdacdf41 11 bytes [B8, 39, E0, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[2844] C:\Windows\system32\WS2_32.dll!WSAConnect + 1                                                                                                                000007fefdaee0f1 11 bytes [B8, 79, DE, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                                              0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                                              0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                                                   0000000076d31330 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                                                               0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                                                       0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                                                   0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                                       0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                                   0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                 0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                                             0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                            0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                                        0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                                          0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                                      0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                            0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                                        0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                                 0000000076d31620 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                                             0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                          0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                                      0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                             0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                                         0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                              0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                                          0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                               0000000076d31750 6 bytes [48, B8, 79, F3, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                                           0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                                             0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                                         0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                                0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                                            0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                  0000000076d31800 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                                                              0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                 0000000076d318b0 6 bytes [48, B8, F9, F6, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                                             0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                                0000000076d31c80 6 bytes [48, B8, 79, EC, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                                            0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                                               0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                                           0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                              0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                                          0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                                  0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                                              0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                                                              0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                                                          0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                            0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                                        0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                                        0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                                    0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                              0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                                          0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                               0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                                           0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                                          0000000076d32aa0 6 bytes [48, B8, 39, F5, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                                      0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                                  0000000076d32b80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                                                              0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                                                        0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                                                         0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                                   0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                     0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                                        0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                                                      0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                                                      0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                                                               0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                                                               0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                                          000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                                          000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                                       000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                           000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                             000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                                       000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                           000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                       000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                                   000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                                  000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                         000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                          000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                                000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                      000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                                000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                           000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                       000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                       000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 49                                                                                                         000007fefe0d4ea1 11 bytes [B8, 79, FA, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                                             000007fefe0d55c8 12 bytes [48, B8, B9, 6C, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                                             000007fefe0eb85c 12 bytes [48, B8, F9, 6A, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW                                                                                                       000007fefe0eb9d0 12 bytes [48, B8, 79, 60, 60, 75, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1920] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA                                                                                                       000007fefe0eba3c 12 bytes [48, B8, B9, 5E, 60, 75, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                                                       0000000076d192d1 5 bytes [B8, F9, 55, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                                                       0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                                                0000000076d31470 6 bytes [48, B8, F9, 5C, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                                            0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                          0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                                                      0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                     0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                                                 0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                                                   0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                                               0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                     0000000076d31570 6 bytes [48, B8, 39, 5B, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                                                 0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                                          0000000076d31620 6 bytes [48, B8, 39, 70, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                                                      0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                   0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                                               0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                                      0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                                                  0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                       0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                                                   0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                                        0000000076d31750 6 bytes [48, B8, F9, 71, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                                                    0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                                                      0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                                                  0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                                         0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                                                     0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                          0000000076d318b0 6 bytes [48, B8, 79, 75, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                                                      0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                                         0000000076d31c80 6 bytes [48, B8, 79, 6E, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                                                     0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                                                        0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                                                    0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                       0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                                                   0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                                           0000000076d320a0 6 bytes [48, B8, B9, 5E, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                                                       0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                     0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                                                 0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                                                 0000000076d329a0 6 bytes [48, B8, 79, 60, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                                             0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                                       0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                                                   0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                                        0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                                                    0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                                                   0000000076d32aa0 6 bytes [48, B8, B9, 73, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                                               0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                                           0000000076d32b80 6 bytes [48, B8, B9, 65, 60, 75]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                                                                       0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                                            0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                              0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                                                 0000000076ae0931 11 bytes [B8, F9, 63, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                                000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                                            000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                                           000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                                  000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                                   000007fefd9c642d 11 bytes [B8, 79, 4B, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                                         000007fefd9c6484 12 bytes [48, B8, 39, 46, 60, 75, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                               000007fefd9c6519 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                                         000007fefd9c6c34 12 bytes [48, B8, 79, 44, 60, 75, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                                    000007fefd9c7ab5 11 bytes [B8, 39, 4D, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                                000007fefd9c8b01 11 bytes [B8, F9, 47, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                                000007fefd9c8c39 11 bytes [B8, B9, 49, 60, 75, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[3080] C:\Windows\system32\WS2_32.dll!connect                                                                                                                               000007fefdac45c0 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                              0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                              0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                                   0000000076d31330 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                                               0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                                       0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                                   0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                       0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                   0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                 0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                             0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                            0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                        0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                          0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                      0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                            0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                        0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                 0000000076d31620 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                             0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                          0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                      0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                             0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                         0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                              0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                          0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                               0000000076d31750 6 bytes [48, B8, 79, F3, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                           0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                             0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                         0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                            0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                  0000000076d31800 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                                              0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                 0000000076d318b0 6 bytes [48, B8, F9, F6, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                             0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                0000000076d31c80 6 bytes [48, B8, 79, EC, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                            0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                               0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                           0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                              0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                          0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                  0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                              0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                                              0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                                          0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                            0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                        0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                        0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                    0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                              0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                          0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                               0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                           0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                          0000000076d32aa0 6 bytes [48, B8, 39, F5, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                      0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                  0000000076d32b80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                                              0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                                        0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                                         0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                   0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                     0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                        0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                                      0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                                      0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                                               0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                                               0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                          000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                          000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                       000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                           000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                             000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                       000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                           000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                       000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                   000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                  000007fefcd1287a 2 bytes [50, C3]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                         000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                          000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                      000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                           000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                       000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3176] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                       000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                                                    0000000076edf928 5 bytes JMP 0000000173b76ca1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                        0000000076edf9e0 5 bytes JMP 0000000173b764e9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                                                        0000000076edfb28 5 bytes JMP 0000000173b75ef9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                  0000000076edfc20 5 bytes JMP 0000000173b731d9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                                             0000000076edfc50 5 bytes JMP 0000000173b715f1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                                                           0000000076edfc80 5 bytes JMP 0000000173b71689
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                             0000000076edfcb0 5 bytes JMP 0000000173b75e61
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                                                  0000000076edfdc8 5 bytes JMP 0000000173b76c09
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                                           0000000076edfe14 5 bytes JMP 0000000173b730a9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                              0000000076edfe44 5 bytes JMP 0000000173b73309
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                                                               0000000076edff24 5 bytes JMP 0000000173b73271
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                                                0000000076edffa4 5 bytes JMP 0000000173b76d39
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                                              0000000076edffec 5 bytes JMP 0000000173b72ee1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                                 0000000076ee0004 5 bytes JMP 0000000173b72db1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                   0000000076ee00b4 5 bytes JMP 0000000173b71ed9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                  0000000076ee01c4 5 bytes JMP 0000000173b72301
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                                 0000000076ee079c 5 bytes JMP 0000000173b76b71
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                                                0000000076ee0814 5 bytes JMP 0000000173b72e49
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                                               0000000076ee08a4 5 bytes JMP 0000000173b72d19
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                                   0000000076ee0df4 5 bytes JMP 0000000173b76581
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtRaiseHardError                                                                               0000000076ee1604 5 bytes JMP 0000000173b74ac9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                             0000000076ee1920 5 bytes JMP 0000000173b73141
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                                         0000000076ee1be4 5 bytes JMP 0000000173b76619
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtSuspendProcess                                                                               0000000076ee1d54 5 bytes JMP 0000000173b73439
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                                0000000076ee1d70 5 bytes JMP 0000000173b733a1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                                           0000000076ee1d8c 5 bytes JMP 0000000173b76dd1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                                                   0000000076ee1ee8 5 bytes JMP 0000000173b769a9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!RtlQueryPerformanceCounter                                                                     0000000076ef88c4 5 bytes JMP 0000000173b71ab1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                                                   0000000076f20d3b 5 bytes JMP 0000000173b72009
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!RtlReportException                                                                             0000000076f6860f 5 bytes JMP 0000000173b74b61
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                                                     0000000076f6e8ab 5 bytes JMP 0000000173b71f71
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                                             0000000076050e00 5 bytes JMP 0000000173b71da9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                              0000000076051072 5 bytes JMP 0000000173b72a21
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                                000000007605499f 5 bytes JMP 0000000173b725f9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                      0000000076063bbb 5 bytes JMP 0000000173b73011
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                                                    0000000076077327 5 bytes JMP 0000000173b72729
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!Process32NextW                                                                              00000000760788da 5 bytes JMP 0000000173b76451
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                     00000000760d2ff1 5 bytes JMP 0000000173b728f1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                                           00000000760f748b 5 bytes JMP 0000000173b746a1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                                           00000000760f74ae 5 bytes JMP 0000000173b747d1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                                                00000000760f7859 5 bytes JMP 0000000173b74901
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                                                00000000760f78d2 5 bytes JMP 0000000173b74a31
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!GetSystemTimeAsFileTime                                                                   0000000075b28f8d 5 bytes JMP 0000000173b71a19
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!CloseHandle                                                                               0000000075b2c436 5 bytes JMP 0000000173b73b59
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!WriteProcessMemory                                                                        0000000075b2eca6 5 bytes JMP 0000000173b73601
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!ExitProcess                                                                               0000000075b2f206 5 bytes JMP 0000000173b72399
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!GetStartupInfoW                                                                           0000000075b2fa89 5 bytes JMP 0000000173b71e41
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!CreateMutexW                                                                              0000000075b31358 5 bytes JMP 0000000173b73ac1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!OpenMutexW                                                                                0000000075b3137f 5 bytes JMP 0000000173b73a29
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                          0000000075b31d29 5 bytes JMP 0000000173b71981
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!GetProcAddress                                                                            0000000075b31e15 5 bytes JMP 0000000173b724c9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                            0000000075b32ab1 5 bytes JMP 0000000173b76029
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExA                                                                            0000000075b32cd9 5 bytes JMP 0000000173b75f91
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                               0000000075b32d17 5 bytes JMP 0000000173b760c1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleA                                                                          0000000075b32e7a 5 bytes JMP 0000000173b718e9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!SleepEx                                                                                   0000000075b33b70 5 bytes JMP 0000000173b72269
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!Sleep                                                                                     0000000075b34496 5 bytes JMP 0000000173b72431
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!CreateThread                                                                              0000000075b34608 5 bytes JMP 0000000173b73569
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!CreateRemoteThread                                                                        0000000075b34631 5 bytes JMP 0000000173b72c81
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\KERNELBASE.dll!CreateFileA                                                                               0000000075b3c734 5 bytes JMP 0000000173b727c1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!GetMessageW                                                                                   0000000075bc78e2 5 bytes JMP 0000000173b74441
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!GetMessageA                                                                                   0000000075bc7bd3 5 bytes JMP 0000000173b743a9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                               0000000075bc8a29 5 bytes JMP 0000000173b757d9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!FindWindowW                                                                                   0000000075bc98fd 5 bytes JMP 0000000173b76289
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!UserClientDllInitialize                                                                       0000000075bcb6ed 5 bytes JMP 0000000173b76e69
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                               0000000075bcd22e 5 bytes JMP 0000000173b75871
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                               0000000075bcee09 5 bytes JMP 0000000173b734d1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!FindWindowA                                                                                   0000000075bcffe6 5 bytes JMP 0000000173b76159
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!FindWindowExA                                                                                 0000000075bd00d9 5 bytes JMP 0000000173b761f1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                                                  0000000075bd05ba 5 bytes JMP 0000000173b74571
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!ShowWindow                                                                                    0000000075bd0dfb 5 bytes JMP 0000000173b75909
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                  0000000075bd12a5 5 bytes JMP 0000000173b76ad9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!SetWindowTextW                                                                                0000000075bd20ec 5 bytes JMP 0000000173b75c99
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                  0000000075bd3baa 5 bytes JMP 0000000173b76a41
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                                                  0000000075bd5f74 5 bytes JMP 0000000173b744d9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!CallNextHookEx                                                                                0000000075bd6285 5 bytes JMP 0000000173b74bf9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                             0000000075bd7603 5 bytes JMP 0000000173b72be9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!SetWindowTextA                                                                                0000000075bd7aee 5 bytes JMP 0000000173b75c01
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                             0000000075bd835c 5 bytes JMP 0000000173b72b51
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamAorW                                                                    0000000075bece54 5 bytes JMP 0000000173b75a39
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                           0000000075bef52b 5 bytes JMP 0000000173b74c91
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!FindWindowExW                                                                                 0000000075bef588 5 bytes JMP 0000000173b76321
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamAorW                                                                 0000000075bf10a0 5 bytes JMP 0000000173b759a1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!MessageBoxExA                                                                                 0000000075c1fcd6 5 bytes JMP 0000000173b75ad1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\USER32.dll!MessageBoxExW                                                                                 0000000075c1fcfa 5 bytes JMP 0000000173b75b69
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\msvcrt.dll!_lock + 41                                                                                    00000000769ba472 5 bytes JMP 0000000173b76f01
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\msvcrt.dll!__p__fmode                                                                                    00000000769c27ce 5 bytes JMP 0000000173b71be1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\msvcrt.dll!__p__environ                                                                                  00000000769ce6cf 5 bytes JMP 0000000173b71b49
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW                                                                                00000000762bc9ec 3 bytes JMP 0000000173b73c89
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW + 4                                                                            00000000762bc9f0 1 byte [FD]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA                                                                                00000000762c2b70 3 bytes JMP 0000000173b73bf1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA + 4                                                                            00000000762c2b74 1 byte [FD]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle                                                                          00000000762c361c 3 bytes JMP 0000000173b740b1
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle + 4                                                                      00000000762c3620 1 byte [FD]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 222                                                                         00000000762c4965 3 bytes JMP 0000000173b76f99
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 226                                                                         00000000762c4969 1 byte [FD]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                              00000000762d70c4 5 bytes JMP 0000000173b74311
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!ControlService                                                                              00000000762d70dc 5 bytes JMP 0000000173b73e51
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!DeleteService                                                                               00000000762d70f4 5 bytes JMP 0000000173b73ee9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA                                                                        00000000762f31f4 5 bytes JMP 0000000173b73f81
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW                                                                        00000000762f3204 5 bytes JMP 0000000173b74019
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExA                                                                           00000000762f3214 5 bytes JMP 0000000173b73d21
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExW                                                                           00000000762f3224 5 bytes JMP 0000000173b73db9
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                              00000000762f3264 5 bytes JMP 0000000173b74279
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[3276] C:\Windows\syswow64\SHELL32.dll!Shell_NotifyIconW                                                                            0000000074e00179 5 bytes JMP 0000000173b74d29
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                                                   0000000076edf928 5 bytes JMP 0000000173b76ca1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                       0000000076edf9e0 5 bytes JMP 0000000173b764e9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                                                       0000000076edfb28 5 bytes JMP 0000000173b75ef9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                 0000000076edfc20 5 bytes JMP 0000000173b731d9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                                            0000000076edfc50 5 bytes JMP 0000000173b715f1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                                                          0000000076edfc80 5 bytes JMP 0000000173b71689
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                            0000000076edfcb0 5 bytes JMP 0000000173b75e61
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                                                 0000000076edfdc8 5 bytes JMP 0000000173b76c09
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                                          0000000076edfe14 5 bytes JMP 0000000173b730a9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                             0000000076edfe44 5 bytes JMP 0000000173b73309
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                                                              0000000076edff24 5 bytes JMP 0000000173b73271
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                                               0000000076edffa4 5 bytes JMP 0000000173b76d39
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                                             0000000076edffec 5 bytes JMP 0000000173b72ee1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                                0000000076ee0004 5 bytes JMP 0000000173b72db1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                  0000000076ee00b4 5 bytes JMP 0000000173b71ed9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                 0000000076ee01c4 5 bytes JMP 0000000173b72301
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                                0000000076ee079c 5 bytes JMP 0000000173b76b71
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                                               0000000076ee0814 5 bytes JMP 0000000173b72e49
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                                              0000000076ee08a4 5 bytes JMP 0000000173b72d19
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                                  0000000076ee0df4 5 bytes JMP 0000000173b76581
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtRaiseHardError                                                                              0000000076ee1604 5 bytes JMP 0000000173b74ac9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                            0000000076ee1920 5 bytes JMP 0000000173b73141
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                                        0000000076ee1be4 5 bytes JMP 0000000173b76619
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSuspendProcess                                                                              0000000076ee1d54 5 bytes JMP 0000000173b73439
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                               0000000076ee1d70 5 bytes JMP 0000000173b733a1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                                          0000000076ee1d8c 5 bytes JMP 0000000173b76dd1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                                                  0000000076ee1ee8 5 bytes JMP 0000000173b769a9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!RtlQueryPerformanceCounter                                                                    0000000076ef88c4 5 bytes JMP 0000000173b71ab1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                                                  0000000076f20d3b 5 bytes JMP 0000000173b72009
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!RtlReportException                                                                            0000000076f6860f 5 bytes JMP 0000000173b74b61
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                                                    0000000076f6e8ab 5 bytes JMP 0000000173b71f71
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                                            0000000076050e00 5 bytes JMP 0000000173b71da9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                             0000000076051072 5 bytes JMP 0000000173b72a21
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                               000000007605499f 5 bytes JMP 0000000173b725f9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                     0000000076063bbb 5 bytes JMP 0000000173b73011
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                                                   0000000076077327 5 bytes JMP 0000000173b72729
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!Process32NextW                                                                             00000000760788da 5 bytes JMP 0000000173b76451
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                    00000000760d2ff1 5 bytes JMP 0000000173b728f1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                                          00000000760f748b 5 bytes JMP 0000000173b746a1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                                          00000000760f74ae 5 bytes JMP 0000000173b747d1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                                               00000000760f7859 5 bytes JMP 0000000173b74901
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                                               00000000760f78d2 5 bytes JMP 0000000173b74a31
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!GetSystemTimeAsFileTime                                                                  0000000075b28f8d 5 bytes JMP 0000000173b71a19
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!CloseHandle                                                                              0000000075b2c436 5 bytes JMP 0000000173b73b59
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!WriteProcessMemory                                                                       0000000075b2eca6 5 bytes JMP 0000000173b73601
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!ExitProcess                                                                              0000000075b2f206 5 bytes JMP 0000000173b72399
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!GetStartupInfoW                                                                          0000000075b2fa89 5 bytes JMP 0000000173b71e41
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!CreateMutexW                                                                             0000000075b31358 5 bytes JMP 0000000173b73ac1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!OpenMutexW                                                                               0000000075b3137f 5 bytes JMP 0000000173b73a29
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                         0000000075b31d29 5 bytes JMP 0000000173b71981
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!GetProcAddress                                                                           0000000075b31e15 5 bytes JMP 0000000173b724c9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                           0000000075b32ab1 5 bytes JMP 0000000173b76029
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExA                                                                           0000000075b32cd9 5 bytes JMP 0000000173b75f91
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                              0000000075b32d17 5 bytes JMP 0000000173b760c1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleA                                                                         0000000075b32e7a 5 bytes JMP 0000000173b718e9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!SleepEx                                                                                  0000000075b33b70 5 bytes JMP 0000000173b72269
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!Sleep                                                                                    0000000075b34496 5 bytes JMP 0000000173b72431
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!CreateThread                                                                             0000000075b34608 5 bytes JMP 0000000173b73569
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!CreateRemoteThread                                                                       0000000075b34631 5 bytes JMP 0000000173b72c81
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!CreateFileA                                                                              0000000075b3c734 5 bytes JMP 0000000173b727c1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW                                                                               00000000762bc9ec 3 bytes JMP 0000000173b73c89
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW + 4                                                                           00000000762bc9f0 1 byte [FD]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA                                                                               00000000762c2b70 3 bytes JMP 0000000173b73bf1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA + 4                                                                           00000000762c2b74 1 byte [FD]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle                                                                         00000000762c361c 3 bytes JMP 0000000173b740b1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle + 4                                                                     00000000762c3620 1 byte [FD]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 222                                                                        00000000762c4965 1 byte JMP 0000000173b76e69
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 224                                                                        00000000762c4967 1 byte [24]
.text     ...                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                             00000000762d70c4 5 bytes JMP 0000000173b74311
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ControlService                                                                             00000000762d70dc 5 bytes JMP 0000000173b73e51
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!DeleteService                                                                              00000000762d70f4 5 bytes JMP 0000000173b73ee9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA                                                                       00000000762f31f4 5 bytes JMP 0000000173b73f81
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW                                                                       00000000762f3204 5 bytes JMP 0000000173b74019
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExA                                                                          00000000762f3214 5 bytes JMP 0000000173b73d21
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExW                                                                          00000000762f3224 5 bytes JMP 0000000173b73db9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                             00000000762f3264 5 bytes JMP 0000000173b74279
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\msvcrt.dll!_lock + 41                                                                                   00000000769ba472 5 bytes JMP 0000000173b76f01
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\msvcrt.dll!__p__fmode                                                                                   00000000769c27ce 5 bytes JMP 0000000173b71be1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\msvcrt.dll!__p__environ                                                                                 00000000769ce6cf 5 bytes JMP 0000000173b71b49
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!GetMessageW                                                                                  0000000075bc78e2 5 bytes JMP 0000000173b74441
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!GetMessageA                                                                                  0000000075bc7bd3 5 bytes JMP 0000000173b743a9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                              0000000075bc8a29 5 bytes JMP 0000000173b757d9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!FindWindowW                                                                                  0000000075bc98fd 5 bytes JMP 0000000173b76289
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!UserClientDllInitialize                                                                      0000000075bcb6ed 5 bytes JMP 0000000173b76f99
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                              0000000075bcd22e 5 bytes JMP 0000000173b75871
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                              0000000075bcee09 5 bytes JMP 0000000173b734d1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!FindWindowA                                                                                  0000000075bcffe6 5 bytes JMP 0000000173b76159
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!FindWindowExA                                                                                0000000075bd00d9 5 bytes JMP 0000000173b761f1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                                                 0000000075bd05ba 5 bytes JMP 0000000173b74571
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!ShowWindow                                                                                   0000000075bd0dfb 5 bytes JMP 0000000173b75909
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                 0000000075bd12a5 5 bytes JMP 0000000173b76ad9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!SetWindowTextW                                                                               0000000075bd20ec 5 bytes JMP 0000000173b75c99
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                 0000000075bd3baa 5 bytes JMP 0000000173b76a41
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                                                 0000000075bd5f74 5 bytes JMP 0000000173b744d9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!CallNextHookEx                                                                               0000000075bd6285 5 bytes JMP 0000000173b74bf9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                            0000000075bd7603 5 bytes JMP 0000000173b72be9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!SetWindowTextA                                                                               0000000075bd7aee 5 bytes JMP 0000000173b75c01
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                            0000000075bd835c 5 bytes JMP 0000000173b72b51
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamAorW                                                                   0000000075bece54 5 bytes JMP 0000000173b75a39
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                          0000000075bef52b 5 bytes JMP 0000000173b74c91
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!FindWindowExW                                                                                0000000075bef588 5 bytes JMP 0000000173b76321
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamAorW                                                                0000000075bf10a0 5 bytes JMP 0000000173b759a1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!MessageBoxExA                                                                                0000000075c1fcd6 5 bytes JMP 0000000173b75ad1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\USER32.dll!MessageBoxExW                                                                                0000000075c1fcfa 5 bytes JMP 0000000173b75b69
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\SHELL32.dll!Shell_NotifyIconW                                                                           0000000074e00179 5 bytes JMP 0000000173b74d29
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!closesocket                                                                                  0000000074c43918 5 bytes JMP 0000000173b75dc9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!WSASocketW                                                                                   0000000074c43cd3 5 bytes JMP 0000000173b75d31
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!socket                                                                                       0000000074c43eb8 5 bytes JMP 0000000173b766b1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!WSASend                                                                                      0000000074c44406 5 bytes JMP 0000000173b72139
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                                                                 0000000074c44889 5 bytes JMP 0000000173b756a9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!recv                                                                                         0000000074c46b0e 5 bytes JMP 0000000173b76879
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!connect                                                                                      0000000074c46bdd 1 byte JMP 0000000173b741e1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!connect + 2                                                                                  0000000074c46bdf 3 bytes {CALL RBP}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!send                                                                                         0000000074c46f01 5 bytes JMP 0000000173b720a1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                                                      0000000074c47089 5 bytes JMP 0000000173b76911
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                                   0000000074c4cc3f 5 bytes JMP 0000000173b767e1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                                                                0000000074c57673 5 bytes JMP 0000000173b75741
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\urlmon.dll!URLDownloadToCacheFileW                                                                      00000000767b6dd3 5 bytes JMP 0000000173b74149
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\urlmon.dll!URLDownloadToFileW                                                                           00000000767b73ab 5 bytes JMP 0000000173b721d1
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\urlmon.dll!URLDownloadToFileA                                                                           000000007682d27c 5 bytes JMP 0000000173b72ab9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                     0000000074b01465 2 bytes [B0, 74]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                    0000000074b014bb 2 bytes [B0, 74]
.text     ...                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                             0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                             0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                  0000000076d31330 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                              0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                      0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                  0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                      0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                  0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                            0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                           0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                       0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                         0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                     0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                           0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                       0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                0000000076d31620 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                            0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                         0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                     0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                            0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                        0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                             0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                         0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                              0000000076d31750 6 bytes [48, B8, 79, F3, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                          0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                            0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                        0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                               0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                           0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                 0000000076d31800 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                             0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                0000000076d318b0 6 bytes [48, B8, F9, F6, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                            0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                               0000000076d31c80 6 bytes [48, B8, 79, EC, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                           0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                              0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                          0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                             0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                         0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                 0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                             0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                             0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                         0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                           0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                       0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                       0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                   0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                             0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                         0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                              0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                          0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                         0000000076d32aa0 6 bytes [48, B8, 39, F5, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                     0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                 0000000076d32b80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                             0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                       0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                        0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                  0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                    0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                       0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                     0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                     0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                              0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                              0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                         000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                         000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                      000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                          000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                            000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                      000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                          000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                      000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                  000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                 000007fefcd1287a 2 bytes [50, C3]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                        000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                         000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                               000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                     000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                               000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                          000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                      000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3524] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                      000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                                               0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                                               0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                                                    0000000076d31330 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                                                                0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                                                        0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                                                    0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                                        0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                                    0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                  0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                                              0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                             0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                                         0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                                           0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                                       0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                             0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                                         0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                                  0000000076d31620 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                                              0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                           0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                                       0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                              0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                                          0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                               0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                                           0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                                0000000076d31750 6 bytes [48, B8, 79, F3, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                                            0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                                              0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                                          0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                                 0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                                             0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                   0000000076d31800 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                                                               0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                  0000000076d318b0 6 bytes [48, B8, F9, F6, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                                              0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant  

  • 0

Advertisements

#17
OGdexter
Posted 17 August 2014 - 08:55 AM

OGdexter

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 106 posts
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                                             0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                                                0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                                            0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                               0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                                           0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                                   0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                                               0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                                                               0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                                                           0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                             0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                                         0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                                         0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                                     0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                               0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                                           0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                                0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                                            0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                                           0000000076d32aa0 6 bytes [48, B8, 39, F5, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                                       0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                                   0000000076d32b80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                                                               0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                                                         0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                                                          0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                                    0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                      0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                                         0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                                                       0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                                                       0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                                                                0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                                                                0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                                           000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                                           000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                                        000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                            000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                              000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                                        000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                            000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                        000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                                    000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                                   000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                          000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                           000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                                 000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                       000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                                 000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                            000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                        000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\taskeng.exe[3604] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                        000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                                                                   0000000076edf928 5 bytes JMP 0000000173b76ca1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                       0000000076edf9e0 5 bytes JMP 0000000173b764e9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                                                                       0000000076edfb28 5 bytes JMP 0000000173b75ef9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                 0000000076edfc20 5 bytes JMP 0000000173b731d9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                                                            0000000076edfc50 5 bytes JMP 0000000173b715f1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                                                                          0000000076edfc80 5 bytes JMP 0000000173b71689
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                                            0000000076edfcb0 5 bytes JMP 0000000173b75e61
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                                                                 0000000076edfdc8 5 bytes JMP 0000000173b76c09
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                                                          0000000076edfe14 5 bytes JMP 0000000173b730a9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                             0000000076edfe44 5 bytes JMP 0000000173b73309
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                                                                              0000000076edff24 5 bytes JMP 0000000173b73271
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                                                               0000000076edffa4 5 bytes JMP 0000000173b76d39
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                                                             0000000076edffec 5 bytes JMP 0000000173b72ee1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                                                0000000076ee0004 5 bytes JMP 0000000173b72db1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                  0000000076ee00b4 5 bytes JMP 0000000173b71ed9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                 0000000076ee01c4 5 bytes JMP 0000000173b72301
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                                                0000000076ee079c 5 bytes JMP 0000000173b76b71
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                                                               0000000076ee0814 5 bytes JMP 0000000173b72e49
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                                                              0000000076ee08a4 5 bytes JMP 0000000173b72d19
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                                                  0000000076ee0df4 5 bytes JMP 0000000173b76581
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtRaiseHardError                                                                                              0000000076ee1604 5 bytes JMP 0000000173b74ac9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                            0000000076ee1920 5 bytes JMP 0000000173b73141
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                                                        0000000076ee1be4 5 bytes JMP 0000000173b76619
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtSuspendProcess                                                                                              0000000076ee1d54 5 bytes JMP 0000000173b73439
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                                               0000000076ee1d70 5 bytes JMP 0000000173b733a1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                                                          0000000076ee1d8c 5 bytes JMP 0000000173b76dd1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                                                                  0000000076ee1ee8 5 bytes JMP 0000000173b769a9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!RtlQueryPerformanceCounter                                                                                    0000000076ef88c4 5 bytes JMP 0000000173b71ab1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                                                                  0000000076f20d3b 5 bytes JMP 0000000173b72009
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!RtlReportException                                                                                            0000000076f6860f 5 bytes JMP 0000000173b74b61
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                                                                    0000000076f6e8ab 5 bytes JMP 0000000173b71f71
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                                                            0000000076050e00 5 bytes JMP 0000000173b71da9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                             0000000076051072 5 bytes JMP 0000000173b72a21
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                                               000000007605499f 5 bytes JMP 0000000173b725f9
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                     0000000076063bbb 5 bytes JMP 0000000173b73011
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                                                                   0000000076077327 5 bytes JMP 0000000173b72729
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!Process32NextW                                                                                             00000000760788da 5 bytes JMP 0000000173b76451
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                                    00000000760d2ff1 5 bytes JMP 0000000173b728f1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                                                          00000000760f748b 5 bytes JMP 0000000173b746a1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                                                          00000000760f74ae 5 bytes JMP 0000000173b747d1
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                                                               00000000760f7859 5 bytes JMP 0000000173b74901
.text     C:\Program Files (x86)\FixCleaner\FixCleaner.exe[3712] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                                                               00000000760f78d2 5 bytes JMP 0000000173b74a31
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                                                               0000000076edf928 5 bytes JMP 0000000173b76ca1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                   0000000076edf9e0 5 bytes JMP 0000000173b764e9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                                                                   0000000076edfb28 5 bytes JMP 0000000173b75ef9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                             0000000076edfc20 5 bytes JMP 0000000173b731d9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                                                        0000000076edfc50 5 bytes JMP 0000000173b715f1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                                                                      0000000076edfc80 5 bytes JMP 0000000173b71689
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                                        0000000076edfcb0 5 bytes JMP 0000000173b75e61
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                                                             0000000076edfdc8 5 bytes JMP 0000000173b76c09
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                                                      0000000076edfe14 5 bytes JMP 0000000173b730a9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                         0000000076edfe44 5 bytes JMP 0000000173b73309
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                                                                          0000000076edff24 5 bytes JMP 0000000173b73271
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                                                           0000000076edffa4 5 bytes JMP 0000000173b76d39
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                                                         0000000076edffec 5 bytes JMP 0000000173b72ee1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                                            0000000076ee0004 5 bytes JMP 0000000173b72db1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                              0000000076ee00b4 5 bytes JMP 0000000173b71ed9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                             0000000076ee01c4 5 bytes JMP 0000000173b72301
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                                            0000000076ee079c 5 bytes JMP 0000000173b76b71
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                                                           0000000076ee0814 5 bytes JMP 0000000173b72e49
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                                                          0000000076ee08a4 5 bytes JMP 0000000173b72d19
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                                              0000000076ee0df4 5 bytes JMP 0000000173b76581
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtRaiseHardError                                                                                          0000000076ee1604 5 bytes JMP 0000000173b74ac9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                        0000000076ee1920 5 bytes JMP 0000000173b73141
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                                                    0000000076ee1be4 5 bytes JMP 0000000173b76619
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtSuspendProcess                                                                                          0000000076ee1d54 5 bytes JMP 0000000173b73439
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                                           0000000076ee1d70 5 bytes JMP 0000000173b733a1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                                                      0000000076ee1d8c 5 bytes JMP 0000000173b76dd1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                                                              0000000076ee1ee8 5 bytes JMP 0000000173b769a9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!RtlQueryPerformanceCounter                                                                                0000000076ef88c4 5 bytes JMP 0000000173b71ab1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                                                              0000000076f20d3b 5 bytes JMP 0000000173b72009
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!RtlReportException                                                                                        0000000076f6860f 5 bytes JMP 0000000173b74b61
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                                                                0000000076f6e8ab 5 bytes JMP 0000000173b71f71
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                                                        0000000076050e00 5 bytes JMP 0000000173b71da9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                         0000000076051072 5 bytes JMP 0000000173b72a21
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                                           000000007605499f 5 bytes JMP 0000000173b725f9
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                 0000000076063bbb 5 bytes JMP 0000000173b73011
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                                                               0000000076077327 5 bytes JMP 0000000173b72729
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!Process32NextW                                                                                         00000000760788da 5 bytes JMP 0000000173b76451
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                                00000000760d2ff1 5 bytes JMP 0000000173b728f1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                                                      00000000760f748b 5 bytes JMP 0000000173b746a1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                                                      00000000760f74ae 5 bytes JMP 0000000173b747d1
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                                                           00000000760f7859 5 bytes JMP 0000000173b74901
.text     C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe[3732] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                                                           00000000760f78d2 5 bytes JMP 0000000173b74a31
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                                                                                        0000000076edf928 5 bytes JMP 0000000173b76ca1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                                            0000000076edf9e0 5 bytes JMP 0000000173b764e9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                                                                                            0000000076edfb28 5 bytes JMP 0000000173b75ef9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                      0000000076edfc20 5 bytes JMP 0000000173b731d9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                                                                                 0000000076edfc50 5 bytes JMP 0000000173b715f1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                                                                                               0000000076edfc80 5 bytes JMP 0000000173b71689
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                                                                 0000000076edfcb0 5 bytes JMP 0000000173b75e61
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                                                                                      0000000076edfdc8 5 bytes JMP 0000000173b76c09
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                                                                               0000000076edfe14 5 bytes JMP 0000000173b730a9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                                                  0000000076edfe44 5 bytes JMP 0000000173b73309
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                                                                                                   0000000076edff24 5 bytes JMP 0000000173b73271
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                                                                                    0000000076edffa4 5 bytes JMP 0000000173b76d39
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                                                                                  0000000076edffec 5 bytes JMP 0000000173b72ee1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                                                                     0000000076ee0004 5 bytes JMP 0000000173b72db1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                       0000000076ee00b4 5 bytes JMP 0000000173b71ed9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                      0000000076ee01c4 5 bytes JMP 0000000173b72301
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                                                                     0000000076ee079c 5 bytes JMP 0000000173b76b71
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                                                                                    0000000076ee0814 5 bytes JMP 0000000173b72e49
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                                                                                   0000000076ee08a4 5 bytes JMP 0000000173b72d19
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                                                                       0000000076ee0df4 5 bytes JMP 0000000173b76581
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtRaiseHardError                                                                                                                   0000000076ee1604 5 bytes JMP 0000000173b74ac9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                 0000000076ee1920 5 bytes JMP 0000000173b73141
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                                                                             0000000076ee1be4 5 bytes JMP 0000000173b76619
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSuspendProcess                                                                                                                   0000000076ee1d54 5 bytes JMP 0000000173b73439
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                                                                    0000000076ee1d70 5 bytes JMP 0000000173b733a1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                                                                               0000000076ee1d8c 5 bytes JMP 0000000173b76dd1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                                                                                       0000000076ee1ee8 5 bytes JMP 0000000173b769a9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!RtlQueryPerformanceCounter                                                                                                         0000000076ef88c4 5 bytes JMP 0000000173b71ab1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                                                                                       0000000076f20d3b 5 bytes JMP 0000000173b72009
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!RtlReportException                                                                                                                 0000000076f6860f 5 bytes JMP 0000000173b74b61
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                                                                                         0000000076f6e8ab 5 bytes JMP 0000000173b71f71
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                                                                                 0000000076050e00 5 bytes JMP 0000000173b71da9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                                                  0000000076051072 5 bytes JMP 0000000173b72a21
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                                                                    000000007605499f 5 bytes JMP 0000000173b725f9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                          0000000076063bbb 5 bytes JMP 0000000173b73011
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                                                                                        0000000076077327 5 bytes JMP 0000000173b72729
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!Process32NextW                                                                                                                  00000000760788da 5 bytes JMP 0000000173b76451
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                                                         00000000760d2ff1 5 bytes JMP 0000000173b728f1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                                                                               00000000760f748b 5 bytes JMP 0000000173b746a1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                                                                               00000000760f74ae 5 bytes JMP 0000000173b747d1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                                                                                    00000000760f7859 5 bytes JMP 0000000173b74901
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                                                                                    00000000760f78d2 5 bytes JMP 0000000173b74a31
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!GetSystemTimeAsFileTime                                                                                                       0000000075b28f8d 5 bytes JMP 0000000173b71a19
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!CloseHandle                                                                                                                   0000000075b2c436 5 bytes JMP 0000000173b73b59
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!WriteProcessMemory                                                                                                            0000000075b2eca6 5 bytes JMP 0000000173b73601
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!ExitProcess                                                                                                                   0000000075b2f206 5 bytes JMP 0000000173b72399
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!GetStartupInfoW                                                                                                               0000000075b2fa89 5 bytes JMP 0000000173b71e41
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!CreateMutexW                                                                                                                  0000000075b31358 5 bytes JMP 0000000173b73ac1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!OpenMutexW                                                                                                                    0000000075b3137f 5 bytes JMP 0000000173b73a29
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                              0000000075b31d29 5 bytes JMP 0000000173b71981
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!GetProcAddress                                                                                                                0000000075b31e15 5 bytes JMP 0000000173b724c9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                                0000000075b32ab1 5 bytes JMP 0000000173b76029
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExA                                                                                                                0000000075b32cd9 5 bytes JMP 0000000173b75f91
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                                   0000000075b32d17 5 bytes JMP 0000000173b760c1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleA                                                                                                              0000000075b32e7a 5 bytes JMP 0000000173b718e9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!SleepEx                                                                                                                       0000000075b33b70 5 bytes JMP 0000000173b72269
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!Sleep                                                                                                                         0000000075b34496 5 bytes JMP 0000000173b72431
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!CreateThread                                                                                                                  0000000075b34608 5 bytes JMP 0000000173b73569
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!CreateRemoteThread                                                                                                            0000000075b34631 5 bytes JMP 0000000173b72c81
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\KERNELBASE.dll!CreateFileA                                                                                                                   0000000075b3c734 5 bytes JMP 0000000173b727c1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!DispatchMessageW                                                                                                                  0000000075bc787b 5 bytes JMP 0000000172f05450
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!GetMessageW                                                                                                                       0000000075bc78e2 5 bytes JMP 0000000173b74441
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!DispatchMessageA                                                                                                                  0000000075bc7bbb 5 bytes JMP 0000000172f05420
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!GetMessageA                                                                                                                       0000000075bc7bd3 5 bytes JMP 0000000173b743a9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                                   0000000075bc8a29 5 bytes JMP 0000000173b757d9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetWindowPos                                                                                                                      0000000075bc8e4e 5 bytes JMP 0000000172f055b0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!FindWindowW                                                                                                                       0000000075bc98fd 5 bytes JMP 0000000173b76289
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!DestroyWindow                                                                                                                     0000000075bc9a55 5 bytes JMP 0000000172f05580
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!UserClientDllInitialize                                                                                                           0000000075bcb6ed 5 bytes JMP 0000000173b76e69
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                                                                   0000000075bcd22e 5 bytes JMP 0000000173b75871
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                                                                   0000000075bcee09 5 bytes JMP 0000000173b734d1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!FindWindowA                                                                                                                       0000000075bcffe6 5 bytes JMP 0000000173b76159
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!FindWindowExA                                                                                                                     0000000075bd00d9 5 bytes JMP 0000000173b761f1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                                                                                      0000000075bd05ba 5 bytes JMP 0000000173b74571
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!ShowWindow                                                                                                                        0000000075bd0dfb 5 bytes JMP 0000000173b75909
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                      0000000075bd12a5 5 bytes JMP 0000000173b76ad9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!EndPaint                                                                                                                          0000000075bd1341 5 bytes JMP 0000000172f05850
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!BeginPaint                                                                                                                        0000000075bd1361 5 bytes JMP 0000000172f057f0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetWindowTextW                                                                                                                    0000000075bd20ec 5 bytes JMP 0000000173b75c99
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!UpdateLayeredWindowIndirect                                                                                                       0000000075bd28da 5 bytes JMP 0000000172f05c70
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                      0000000075bd3baa 5 bytes JMP 0000000173b76a41
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetCursor                                                                                                                         0000000075bd41f6 5 bytes JMP 0000000172f04f80
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                                                                                      0000000075bd5f74 5 bytes JMP 0000000173b744d9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!CallNextHookEx                                                                                                                    0000000075bd6285 5 bytes JMP 0000000173b74bf9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                                                                 0000000075bd7603 5 bytes JMP 0000000173b72be9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetWindowTextA                                                                                                                    0000000075bd7aee 5 bytes JMP 0000000173b75c01
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!BringWindowToTop                                                                                                                  0000000075bd7b3b 5 bytes JMP 0000000172f057d0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                                                                 0000000075bd835c 5 bytes JMP 0000000173b72b51
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!AnimateWindow                                                                                                                     0000000075bdb531 5 bytes JMP 0000000172f05620
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!UpdateLayeredWindow                                                                                                               0000000075bdba4a 5 bytes JMP 0000000172f05ba0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamAorW                                                                                                        0000000075bece54 5 bytes JMP 0000000173b75a39
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!WindowFromPoint                                                                                                                   0000000075beed12 5 bytes JMP 0000000172f04fa0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetCapture                                                                                                                        0000000075beed56 5 bytes JMP 0000000172f056f0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!SetForegroundWindow                                                                                                               0000000075bef170 5 bytes JMP 0000000172f056b0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                                                               0000000075bef52b 5 bytes JMP 0000000173b74c91
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!FindWindowExW                                                                                                                     0000000075bef588 5 bytes JMP 0000000173b76321
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamAorW                                                                                                     0000000075bf10a0 5 bytes JMP 0000000173b759a1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!MessageBoxExA                                                                                                                     0000000075c1fcd6 5 bytes JMP 0000000173b75ad1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\USER32.dll!MessageBoxExW                                                                                                                     0000000075c1fcfa 5 bytes JMP 0000000173b75b69
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\GDI32.dll!BitBlt                                                                                                                             0000000075cc5ea6 5 bytes JMP 0000000172f04fd0
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\msvcrt.dll!_lock + 41                                                                                                                        00000000769ba472 5 bytes JMP 0000000173b76f01
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\msvcrt.dll!__p__fmode                                                                                                                        00000000769c27ce 5 bytes JMP 0000000173b71be1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\msvcrt.dll!__p__environ                                                                                                                      00000000769ce6cf 5 bytes JMP 0000000173b71b49
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW                                                                                                                    00000000762bc9ec 3 bytes JMP 0000000173b73c89
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW + 4                                                                                                                00000000762bc9f0 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA                                                                                                                    00000000762c2b70 3 bytes JMP 0000000173b73bf1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA + 4                                                                                                                00000000762c2b74 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle                                                                                                              00000000762c361c 3 bytes JMP 0000000173b740b1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle + 4                                                                                                          00000000762c3620 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 222                                                                                                             00000000762c4965 3 bytes JMP 0000000173b76f99
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 226                                                                                                             00000000762c4969 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                  00000000762d70c4 5 bytes JMP 0000000173b74311
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!ControlService                                                                                                                  00000000762d70dc 5 bytes JMP 0000000173b73e51
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!DeleteService                                                                                                                   00000000762d70f4 5 bytes JMP 0000000173b73ee9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA                                                                                                            00000000762f31f4 5 bytes JMP 0000000173b73f81
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW                                                                                                            00000000762f3204 5 bytes JMP 0000000173b74019
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExA                                                                                                               00000000762f3214 5 bytes JMP 0000000173b73d21
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExW                                                                                                               00000000762f3224 5 bytes JMP 0000000173b73db9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                  00000000762f3264 5 bytes JMP 0000000173b74279
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!closesocket                                                                                                                       0000000074c43918 5 bytes JMP 0000000173b75dc9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!WSASocketW                                                                                                                        0000000074c43cd3 5 bytes JMP 0000000173b75d31
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!socket                                                                                                                            0000000074c43eb8 5 bytes JMP 0000000173b766b1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!WSASend                                                                                                                           0000000074c44406 5 bytes JMP 0000000173b72139
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                                                                                                      0000000074c44889 5 bytes JMP 0000000173b756a9
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!recv                                                                                                                              0000000074c46b0e 5 bytes JMP 0000000173b76879
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!connect                                                                                                                           0000000074c46bdd 1 byte JMP 0000000173b741e1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!connect + 2                                                                                                                       0000000074c46bdf 3 bytes {CALL RBP}
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!send                                                                                                                              0000000074c46f01 5 bytes JMP 0000000173b720a1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                                                                                           0000000074c47089 5 bytes JMP 0000000173b76911
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                                                                        0000000074c4cc3f 5 bytes JMP 0000000173b767e1
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                                                                                                     0000000074c57673 5 bytes JMP 0000000173b75741
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69                                                                                                          0000000074b01465 2 bytes [B0, 74]
.text     C:\PROGRA~2\Raptr\raptr.exe[3844] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155                                                                                                         0000000074b014bb 2 bytes [B0, 74]
.text     ...                                                                                                                                                                                                * 2
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                                                                                     0000000076edf928 5 bytes JMP 0000000173b76ca1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                                         0000000076edf9e0 5 bytes JMP 0000000173b764e9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                                                                                         0000000076edfb28 5 bytes JMP 0000000173b75ef9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                   0000000076edfc20 5 bytes JMP 0000000173b731d9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                                                                              0000000076edfc50 5 bytes JMP 0000000173b715f1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                                                                                            0000000076edfc80 5 bytes JMP 0000000173b71689
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                                                              0000000076edfcb0 5 bytes JMP 0000000173b75e61
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                                                                                   0000000076edfdc8 5 bytes JMP 0000000173b76c09
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                                                                            0000000076edfe14 5 bytes JMP 0000000173b730a9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                                               0000000076edfe44 5 bytes JMP 0000000173b73309
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                                                                                                0000000076edff24 5 bytes JMP 0000000173b73271
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                                                                                 0000000076edffa4 5 bytes JMP 0000000173b76d39
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                                                                               0000000076edffec 5 bytes JMP 0000000173b72ee1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                                                                  0000000076ee0004 5 bytes JMP 0000000173b72db1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                    0000000076ee00b4 5 bytes JMP 0000000173b71ed9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                   0000000076ee01c4 5 bytes JMP 0000000173b72301
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                                                                  0000000076ee079c 5 bytes JMP 0000000173b76b71
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                                                                                 0000000076ee0814 5 bytes JMP 0000000173b72e49
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                                                                                0000000076ee08a4 5 bytes JMP 0000000173b72d19
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                                                                    0000000076ee0df4 5 bytes JMP 0000000173b76581
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtRaiseHardError                                                                                                                0000000076ee1604 5 bytes JMP 0000000173b74ac9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                              0000000076ee1920 5 bytes JMP 0000000173b73141
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                                                                          0000000076ee1be4 5 bytes JMP 0000000173b76619
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtSuspendProcess                                                                                                                0000000076ee1d54 5 bytes JMP 0000000173b73439
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                                                                 0000000076ee1d70 5 bytes JMP 0000000173b733a1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                                                                            0000000076ee1d8c 5 bytes JMP 0000000173b76dd1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                                                                                    0000000076ee1ee8 5 bytes JMP 0000000173b769a9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!RtlQueryPerformanceCounter                                                                                                      0000000076ef88c4 5 bytes JMP 0000000173b71ab1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                                                                                    0000000076f20d3b 5 bytes JMP 0000000173b72009
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!RtlReportException                                                                                                              0000000076f6860f 5 bytes JMP 0000000173b74b61
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                                                                                      0000000076f6e8ab 5 bytes JMP 0000000173b71f71
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                                                                              0000000076050e00 5 bytes JMP 0000000173b71da9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                                               0000000076051072 5 bytes JMP 0000000173b72a21
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                                                                 000000007605499f 5 bytes JMP 0000000173b725f9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                       0000000076063bbb 5 bytes JMP 0000000173b73011
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                                                                                     0000000076077327 5 bytes JMP 0000000173b72729
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!Process32NextW                                                                                                               00000000760788da 5 bytes JMP 0000000173b76451
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                                                      00000000760d2ff1 5 bytes JMP 0000000173b728f1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                                                                            00000000760f748b 5 bytes JMP 0000000173b746a1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                                                                            00000000760f74ae 5 bytes JMP 0000000173b747d1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                                                                                 00000000760f7859 5 bytes JMP 0000000173b74901
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                                                                                 00000000760f78d2 5 bytes JMP 0000000173b74a31
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!GetSystemTimeAsFileTime                                                                                                    0000000075b28f8d 5 bytes JMP 0000000173b71a19
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!CloseHandle                                                                                                                0000000075b2c436 5 bytes JMP 0000000173b73b59
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!WriteProcessMemory                                                                                                         0000000075b2eca6 5 bytes JMP 0000000173b73601
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!ExitProcess                                                                                                                0000000075b2f206 5 bytes JMP 0000000173b72399
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!GetStartupInfoW                                                                                                            0000000075b2fa89 5 bytes JMP 0000000173b71e41
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!CreateMutexW                                                                                                               0000000075b31358 5 bytes JMP 0000000173b73ac1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!OpenMutexW                                                                                                                 0000000075b3137f 5 bytes JMP 0000000173b73a29
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                           0000000075b31d29 5 bytes JMP 0000000173b71981
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!GetProcAddress                                                                                                             0000000075b31e15 5 bytes JMP 0000000173b724c9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                             0000000075b32ab1 5 bytes JMP 0000000173b76029
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExA                                                                                                             0000000075b32cd9 5 bytes JMP 0000000173b75f91
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                                0000000075b32d17 5 bytes JMP 0000000173b760c1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleA                                                                                                           0000000075b32e7a 5 bytes JMP 0000000173b718e9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!SleepEx                                                                                                                    0000000075b33b70 5 bytes JMP 0000000173b72269
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!Sleep                                                                                                                      0000000075b34496 5 bytes JMP 0000000173b72431
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!CreateThread                                                                                                               0000000075b34608 5 bytes JMP 0000000173b73569
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!CreateRemoteThread                                                                                                         0000000075b34631 5 bytes JMP 0000000173b72c81
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\KERNELBASE.dll!CreateFileA                                                                                                                0000000075b3c734 5 bytes JMP 0000000173b727c1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW                                                                                                                 00000000762bc9ec 3 bytes JMP 0000000173b73c89
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW + 4                                                                                                             00000000762bc9f0 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA                                                                                                                 00000000762c2b70 3 bytes JMP 0000000173b73bf1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA + 4                                                                                                             00000000762c2b74 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle                                                                                                           00000000762c361c 3 bytes JMP 0000000173b740b1
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!CloseServiceHandle + 4                                                                                                       00000000762c3620 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 222                                                                                                          00000000762c4965 3 bytes JMP 0000000173b76f99
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 226                                                                                                          00000000762c4969 1 byte [FD]
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                               00000000762d70c4 5 bytes JMP 0000000173b74311
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!ControlService                                                                                                               00000000762d70dc 5 bytes JMP 0000000173b73e51
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!DeleteService                                                                                                                00000000762d70f4 5 bytes JMP 0000000173b73ee9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA                                                                                                         00000000762f31f4 5 bytes JMP 0000000173b73f81
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW                                                                                                         00000000762f3204 5 bytes JMP 0000000173b74019
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExA                                                                                                            00000000762f3214 5 bytes JMP 0000000173b73d21
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExW                                                                                                            00000000762f3224 5 bytes JMP 0000000173b73db9
.text     C:\PROGRA~2\Raptr\raptr_im.exe[4072] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                               00000000762f3264 5 bytes JMP 0000000173b74279
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                                         0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                                         0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                                              0000000076d31330 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                                                          0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                                                  0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                                              0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                                  0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                              0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                            0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                                        0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                       0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                                   0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                                     0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                                 0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                       0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                                   0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                            0000000076d31620 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                                        0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                     0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                                 0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                        0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                                    0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                         0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                                     0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                          0000000076d31750 6 bytes [48, B8, 79, F3, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                                      0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                                        0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                                    0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                           0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                                       0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                             0000000076d31800 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                                                         0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                            0000000076d318b0 6 bytes [48, B8, F9, F6, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                                        0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                           0000000076d31c80 6 bytes [48, B8, 79, EC, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                                       0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                                          0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                                      0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                         0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                                     0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                             0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                                         0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                                                         0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                                                     0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                       0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                                   0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                                   0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                               0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                         0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                                     0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                          0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                                      0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                                     0000000076d32aa0 6 bytes [48, B8, 39, F5, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                                 0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                             0000000076d32b80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                                                         0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                                                   0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                                     000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                                     000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                                  000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                      000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                        000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                                  000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                      000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                  000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                              000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                             000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                    000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                     000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                           000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                 000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                           000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                      000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                  000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[1556] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                  000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                        000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                        000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                     000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                         000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                           000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                     000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                         000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                     000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                 000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                000007fefcd1287a 2 bytes [50, C3]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[3484] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                       000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                                               0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                                               0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                                                    0000000076d31330 6 bytes [48, B8, 79, EC, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                                                                0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                                                        0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                                                    0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                                        0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                                    0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                  0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                                              0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                             0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                                         0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                                           0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                                       0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                             0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                                         0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                                  0000000076d31620 6 bytes [48, B8, F9, E8, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                                              0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                           0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                                       0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                              0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                                          0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                               0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                                           0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                                0000000076d31750 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                                            0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                                              0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                                          0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                                 0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                                             0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                   0000000076d31800 6 bytes [48, B8, B9, EA, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                                                               0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                  0000000076d318b0 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                                              0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                                 0000000076d31c80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                                             0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                                                0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                                            0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                               0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                                           0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                                   0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                                               0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                                                               0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                                                           0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                             0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                                         0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                                         0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                                     0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                               0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                                           0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                                0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                                            0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                                           0000000076d32aa0 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                                       0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                                                         0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                                                          0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                                    0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                      0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                                         0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                                                       0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                                                       0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                                                                0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                                                                0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                                           000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                                           000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                                        000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                            000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                              000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                                        000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                            000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                        000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                                    000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                                   000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                          000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                           000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                                 000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                       000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                                 000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                            000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                        000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                        000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!WSASend + 1                                                                                                                   000007fefdac13b1 11 bytes [B8, F9, BE, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!closesocket                                                                                                                   000007fefdac18e0 12 bytes [48, B8, 39, BD, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!WSASocketW + 1                                                                                                                000007fefdac1bd1 11 bytes [B8, 79, BB, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!WSARecv + 1                                                                                                                   000007fefdac2201 11 bytes [B8, F9, E1, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!GetAddrInfoW                                                                                                                  000007fefdac23c0 12 bytes [48, B8, 79, A6, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!connect                                                                                                                       000007fefdac45c0 12 bytes [48, B8, 79, 67, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!send + 1                                                                                                                      000007fefdac8001 11 bytes [B8, B9, B9, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!gethostbyname                                                                                                                 000007fefdac8df0 7 bytes [48, B8, 39, A8, 60, 75, 00]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!gethostbyname + 9                                                                                                             000007fefdac8df9 3 bytes [00, 50, C3]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!socket + 1                                                                                                                    000007fefdacde91 11 bytes [B8, F9, DA, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!recv + 1                                                                                                                      000007fefdacdf41 11 bytes [B8, 39, E0, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\WS2_32.dll!WSAConnect + 1                                                                                                                000007fefdaee0f1 11 bytes [B8, 79, DE, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 49                                                                                                          000007fefe0d4ea1 11 bytes [B8, F9, F6, 60, 75, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                                              000007fefe0d55c8 12 bytes [48, B8, B9, 6C, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                                              000007fefe0eb85c 12 bytes [48, B8, F9, 6A, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW                                                                                                        000007fefe0eb9d0 12 bytes [48, B8, 79, 60, 60, 75, 00, ...]
.text     C:\Windows\System32\svchost.exe[4304] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA                                                                                                        000007fefe0eba3c 12 bytes [48, B8, B9, 5E, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                                   0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                                   0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                                        0000000076d31330 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                                                    0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                                            0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                                        0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                            0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                        0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                      0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                                  0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                 0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                             0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                               0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                           0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                 0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                             0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                      0000000076d31620 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                                  0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                               0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                           0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                  0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                              0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                   0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                               0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                    0000000076d31750 6 bytes [48, B8, 79, F3, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                                0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                                  0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                              0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                     0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                                 0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                       0000000076d31800 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                                                   0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                      0000000076d318b0 6 bytes [48, B8, F9, F6, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                                  0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                     0000000076d31c80 6 bytes [48, B8, 79, EC, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                                 0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                                    0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                                0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                   0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                               0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                       0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                                   0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                                                   0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                                               0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                 0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                             0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                             0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                         0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                   0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                               0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                    0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                                0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                               0000000076d32aa0 6 bytes [48, B8, 39, F5, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                           0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                       0000000076d32b80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                                                   0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                                             0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                                              0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                        0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                          0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                             0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                                           0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                                           0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                                                    0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                                                    0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                               000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                               000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                            000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                  000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                            000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                            000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                        000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                       000007fefcd1287a 2 bytes [50, C3]
.text     C:\Program Files (x86)\Raptr\raptr_ep64.exe[4592] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                              000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                                                               0000000076d192d1 5 bytes [B8, 39, 69, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                                                               0000000076d192d7 5 bytes [00, 00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                                                                    0000000076d31330 6 bytes [48, B8, B9, F1, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                                                                0000000076d31338 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                                                                        0000000076d313a0 6 bytes [48, B8, B9, D5, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                                                                    0000000076d313a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                                                                        0000000076d31470 6 bytes [48, B8, 79, C2, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                                                                    0000000076d31478 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                  0000000076d31510 6 bytes [48, B8, F9, 32, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                                                              0000000076d31518 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                             0000000076d31530 6 bytes [48, B8, 39, 1C, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                                                                         0000000076d31538 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                                                           0000000076d31550 6 bytes [48, B8, F9, 1D, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                                                                                                       0000000076d31558 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                             0000000076d31570 6 bytes [48, B8, B9, C0, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                                                                         0000000076d31578 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                                  0000000076d31620 6 bytes [48, B8, 39, EE, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                                                              0000000076d31628 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                           0000000076d31650 6 bytes [48, B8, 79, 2F, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                                                                       0000000076d31658 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                              0000000076d31670 6 bytes [48, B8, 79, 36, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                                                                          0000000076d31678 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                               0000000076d31700 6 bytes [48, B8, B9, 34, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                                                           0000000076d31708 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                                0000000076d31750 6 bytes [48, B8, 79, F3, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                                                            0000000076d31758 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                                                              0000000076d31780 6 bytes [48, B8, 39, 2A, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                                                                          0000000076d31788 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                                 0000000076d31790 6 bytes [48, B8, B9, 26, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                                                             0000000076d31798 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                   0000000076d31800 6 bytes [48, B8, F9, EF, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                                                               0000000076d31808 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                  0000000076d318b0 6 bytes [48, B8, F9, F6, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                                                              0000000076d318b8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                                 0000000076d31c80 6 bytes [48, B8, 79, EC, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                                                             0000000076d31c88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                                                                0000000076d31cd0 6 bytes [48, B8, 79, 28, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                                                            0000000076d31cd8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                               0000000076d31d30 6 bytes [48, B8, F9, 24, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                                                           0000000076d31d38 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                                   0000000076d320a0 6 bytes [48, B8, 79, D7, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                                                               0000000076d320a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError                                                                                                               0000000076d325e0 6 bytes [48, B8, 79, 83, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 8                                                                                                           0000000076d325e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                             0000000076d327e0 6 bytes [48, B8, 39, 31, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 8                                                                                                         0000000076d327e8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                                         0000000076d329a0 6 bytes [48, B8, 39, D9, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                                                                     0000000076d329a8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                               0000000076d32a80 6 bytes [48, B8, 79, 3D, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                                                           0000000076d32a88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                                0000000076d32a90 6 bytes [48, B8, B9, 3B, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 8                                                                                                            0000000076d32a98 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                                           0000000076d32aa0 6 bytes [48, B8, 39, F5, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                                                                       0000000076d32aa8 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                                   0000000076d32b80 6 bytes [48, B8, 39, E7, 60, 75]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 8                                                                                                               0000000076d32b88 4 bytes [00, 00, 50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\ntdll.dll!RtlReportException + 1                                                                                                         0000000076da3201 11 bytes [B8, 39, 85, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                                           000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                                           000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                                        000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                            000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                              000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                                        000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                            000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                        000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                                    000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                                   000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                          000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                           000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                                 000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                       000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                                 000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                            000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                        000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\DllHost.exe[5316] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                        000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!Process32NextW + 1                                                                                                           0000000076ac1b21 11 bytes [B8, F9, D3, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                                                                     0000000076ac1c10 12 bytes [48, B8, F9, 39, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                       0000000076addb80 12 bytes [48, B8, B9, 2D, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                                                                          0000000076ae0931 11 bytes [B8, 79, E5, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                                                                        0000000076b152f1 11 bytes [B8, B9, 7A, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                                                                        0000000076b15311 11 bytes [B8, 39, 77, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                                                                 0000000076b2a5e0 12 bytes [48, B8, B9, 81, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                                                                 0000000076b2a6f0 12 bytes [48, B8, 39, 7E, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!CloseHandle + 1                                                                                                            000007fefccd1861 11 bytes [B8, 79, 52, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                                                            000007fefccd2db1 11 bytes [B8, B9, C7, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!GetProcAddress + 1                                                                                                         000007fefccd3461 11 bytes [B8, 79, C9, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                             000007fefccd8ef0 12 bytes [48, B8, F9, C5, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!CreateMutexW                                                                                                               000007fefccd94c0 12 bytes [48, B8, B9, 50, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExA + 1                                                                                                         000007fefccdbfd1 11 bytes [B8, 39, C4, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!OpenMutexW + 1                                                                                                             000007fefcce2af1 11 bytes [B8, F9, 4E, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory                                                                                                         000007fefcd04350 12 bytes [48, B8, B9, 42, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 1                                                                                                     000007fefcd12871 8 bytes [B8, 39, 23, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!CreateRemoteThread + 10                                                                                                    000007fefcd1287a 2 bytes [50, C3]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!CreateThread + 1                                                                                                           000007fefcd128b1 11 bytes [B8, F9, 40, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                                                            000007fefd9c642d 11 bytes [B8, 39, 5B, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                                                                  000007fefd9c6484 12 bytes [48, B8, F9, 55, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle + 1                                                                                                        000007fefd9c6519 11 bytes [B8, 39, 62, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                                                                  000007fefd9c6c34 12 bytes [48, B8, 39, 54, 60, 75, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                                                             000007fefd9c7ab5 11 bytes [B8, F9, 5C, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                                                                         000007fefd9c8b01 11 bytes [B8, B9, 57, 60, 75, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                                                                         000007fefd9c8c39 11 bytes [B8, 79, 59, 60, 75, 00, 00, ...]
.text     C:\Users\Owner\Downloads\aswMBR.exe[1492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                  0000000074b01465 2 bytes [B0, 74]
.text     C:\Users\Owner\Downloads\aswMBR.exe[1492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                 0000000074b014bb 2 bytes [B0, 74]
.text     ...                                                                                                                                                                                                * 2
 
---- Threads - GMER 2.1 ----
 
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [3484:4008]                                                                                                                                     000007fefa112bf8
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [3484:4084]                                                                                                                                     000007fee8ee4830
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [3484:4808]                                                                                                                                     000007fef7dc5124
---- Processes - GMER 2.1 ----
 
Library   C:\Users\Owner\AppData\Local\Temp\_av4_\aswEngin.dll (*** suspicious ***) @ C:\Users\Owner\Downloads\aswMBR.exe [1492] (High level antivirus engine/ALWIL Software)(2014-08-16 22:42:37)           0000000064280000
Library   C:\Users\Owner\AppData\Local\Temp\_av4_\aswScan.dll (*** suspicious ***) @ C:\Users\Owner\Downloads\aswMBR.exe [1492] (Low level antivirus engine/ALWIL Software)(2014-08-16 22:42:37)             0000000064200000
Library   C:\Users\Owner\AppData\Local\Temp\_av4_\MSVCP71.dll (*** suspicious ***) @ C:\Users\Owner\Downloads\aswMBR.exe [1492] (Microsoft® C++ Runtime Library/Microsoft Corporation)(2014-08-16 22:42:37)  000000007c3a0000
Library   C:\Users\Owner\AppData\Local\Temp\_av4_\aswCmnOS.dll (*** suspicious ***) @ C:\Users\Owner\Downloads\aswMBR.exe [1492] (Antivirus HW dependent library/ALWIL Software)(2014-08-16 22:42:37)        0000000064000000
Library   C:\Users\Owner\AppData\Local\Temp\_av4_\aswCmnB.dll (*** suspicious ***) @ C:\Users\Owner\Downloads\aswMBR.exe [1492] (High level portable functions/ALWIL Software)(2014-08-16 22:42:37)          0000000064080000
Library   C:\Users\Owner\AppData\Local\Temp\_av4_\aswCmnS.dll (*** suspicious ***) @ C:\Users\Owner\Downloads\aswMBR.exe [1492] (Common non-portable functions/ALWIL Software)(2014-08-16 22:42:37)          0000000064100000
 
---- Registry - GMER 2.1 ----
 
Reg       HKLM\SYSTEM\ControlSet002\Control@PreshutdownOrder                                                                                                                                                 wuauserv?gpsvc?trustedinstaller?
Reg       HKLM\SYSTEM\ControlSet002\Control@WaitToKillServiceTimeout                                                                                                                                         500
Reg       HKLM\SYSTEM\ControlSet002\Control@CurrentUser                                                                                                                                                      USERNAME
Reg       HKLM\SYSTEM\ControlSet002\Control@BootDriverFlags                                                                                                                                                  0
Reg       HKLM\SYSTEM\ControlSet002\Control@ServiceControlManagerExtension                                                                                                                                   %systemroot%\system32\scext.dll
Reg       HKLM\SYSTEM\ControlSet002\Control@SystemStartOptions                                                                                                                                                NOEXECUTE=OPTIN
Reg       HKLM\SYSTEM\ControlSet002\Control@SystemBootDevice                                                                                                                                                 multi(0)disk(0)rdisk(0)partition(2)
Reg       HKLM\SYSTEM\ControlSet002\Control@FirmwareBootDevice                                                                                                                                               multi(0)disk(0)rdisk(0)partition(1)
 
---- EOF - GMER 2.1 ----

  • 0

#18
Biscuithd
Posted 17 August 2014 - 10:03 AM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts

I'm not seeing any Malware (other than the little bit we've already removed. I'm wondering we're looking at a driver conflict or something like that. Before I turn you over to the Hardware group, you could try updating your drivers.
 
How to update drivers.

  • On you keyboard press the Windows key and R at the same time. A Run box will open.
  • Type: devmgmt.msc .
  • Press OK, now Device Manager should open.
  • Expand a heading and highlight any item. Click Action (at the top of the window next to "File"). Press Update Driver Software.
     

Another thing you might try is this:

 

Download Windows Repair (All In One) from here.

It will allow you to repair common issues with your computer.  When using this tool you can select the particular fixes you would like to launch and start the repair process.

Please download the tool to somewhere you can find it.

Double click to open and follow the prompts to install.

Once installed click on the tab Step 3 and proceed from there. Run Chkdsk and System File Checker (if you have done this before move to the next action). When that is finished move to the Start Repairs tab.

At Start Repairs press the button Start

If a pop up asks you whether you want create a restore point or back up your registry press yes and follow the backup registry option.

After that is complete press Start again:

At the list that presents put a check (tick) in the following:

• Reset Registry Permissions
• Reset File Permissions
• Register System Files
• Repair WMI
• Repair Internet Explorer
• Repair MDAC & MS Jet
• Repair Hosts File
• Remove Policies Set By Infections
• Repair Winsock & DNS Cache
• Remove Temp Files

Also put a check in the Restart/Shutdown System When Finished (lower right) box.

and in Restart System

Then click on the Start button if it doesn't do it automatically

When it is finished check how your computer is running and if your machines problems have gone.

Come back and tell me how it went.


  • 0

#19
OGdexter
Posted 17 August 2014 - 03:22 PM

OGdexter

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 106 posts

one "unexpected shutdown" already

now i have a bunch of new icons on my desktop, don't know what most of them are. most are not shortcuts, takes up half the screen now (ohhh swell)

 

 here are some logs when done

 

 Malwarebytes Anti-Malware

www.malwarebytes.org
 
Scan Date: 8/17/2014
Scan Time: 10:03:40 AM
Logfile: malwarebytes log.txt
Administrator: Yes
 
Version: 2.00.2.1012
Malware Database: v2014.08.17.04
Rootkit Database: v2014.08.16.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Owner
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 294753
Time Elapsed: 9 min, 13 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 3
PUP.Optional.VuzeTB.A, HKU\S-1-5-21-1458884842-1907561465-2693528813-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{05478A66-EDB6-4A22-A870-A5987F80A7DA}, Quarantined, [73351cabdaa1013588a3224c5da58080], 
PUP.Optional.VuzeTB.A, HKU\S-1-5-21-1458884842-1907561465-2693528813-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{05478A66-EDB6-4A22-A870-A5987F80A7DA}, Quarantined, [73351cabdaa1013588a3224c5da58080], 
PUP.Optional.Spigot.A, HKU\S-1-5-21-1458884842-1907561465-2693528813-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Search Settings, Quarantined, [723665625d1ed5619753c97add2746ba], 
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 1
PUP.Optional.Spigot.A, HKU\S-1-5-21-1458884842-1907561465-2693528813-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://search.yahoo....r=spigot-yhp-ie, Good: (www.google.com), Bad: (http://search.yahoo.com/?type=994519&fr=spigot-yhp-ie),Replaced,[0a9e9f2897e4eb4bcfe5f2d68a7a56aa]
 
Folders: 3
PUP.Optional.Conduit.A, C:\Users\Owner\AppData\Local\Temp\ct2504091, Quarantined, [862219ae4d2ec472defd7d3b53afdd23], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
 
Files: 15
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj\000005.sst, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj\000010.log, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj\CURRENT, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj\LOCK, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj\LOG, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj\LOG.old, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hbcennhacfaagdopikcegfcobcadeocj\MANIFEST-000009, Quarantined, [e0c82d9af8833bfbb3023e8d33cfc13f], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp\000005.sst, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp\000010.log, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp\CURRENT, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp\LOCK, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp\LOG, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp\LOG.old, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pfndaklgolladniicklehhancnlgocpp\MANIFEST-000009, Quarantined, [9117c9fe2556ff37bff7913af80a0bf5], 
PUP.Optional.Spigot.A, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (      "startup_urls": [ "http://search.yahoo....r=spigot-yhp-ch" ],), Replaced,[b2f6f7d0cbb066d04872cb3825e07d83]
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
 
Tweaking.com - Windows Repair Change Log.
 
v2.8.6
Updated the Register System Files repair.
 
Major improvement to how the system detects when the repairs start. On slower systems, and when I user had a lot of programs open, it caused the repairs to start to slowly and so the program would think the repair is done and start the next repair, causing 2 or more repairs running at once. The program can now tell and wait when a repair starts.
 
Added new information to the program asking the user to do a "Clean Boot" before running the repairs. I also wrote a guide on how to do a proper clean boot for users. (Program has a link to point them to the guide on the site)
All the other guides I found, for some reason, didn't bother including the task scheduler, which programs also startup from.
The reason for doing a clean boot is because other 3rd party programs can interfere with the repairs. There have been multiple times I have seen users running the repairs on a system running 140+ processes and those programs interfered with the repairs, keeping them from even finishing.
Once those users did a clean boot the repairs finished without any problems and even finished faster since the system was under less of a load.
 
v2.8.5
Improved File Permissions Repair.
 
Updated and improved the Repair Winsock & DNS Cache.
 
Updated and improved the Repair Windows Updates.
 
v2.8.4
Fixed a bug where the program would crash after opening a few of the windows a few times. This was caused by my resize control for the resizable windows in the program. It was hooking into windows to keep the controls from flicking when resizing. Well that subclass hook would sometimes cause the program to crash when too many windows where opened and closed quickly. The purpose of this hook was nothing more than for looks. I have since removed that from the code and while the controls may flicker when resized the program no longer crashes :-)
 
Per user request, I added a option under the settings tab to lock or unlock the repair list while the repairs are running.
 
Per user request, I added a option under the settings tab to show or hide the output of the repairs to the cmd.exe windows. Hiding the output greatly increases the repair speeds as it takes a lot of CPU to draw all the text to the windows.
 
I have updated multiple repairs to fix the path in the registry to the oleaut32.dll file on the Windows system starting with vista and newer. In XP the file name was the only thing in these registry keys, not the file path. With a fresh install of vista, 7 and newer those registry keys have the full path. When ever you register oleaut32.dll it changes those registry keys to have the file name only, the dll itself does this. Everything works fine like that but some select programs such as VirtualBox will complain and not run. By simply putting the full paths back fixes this bug for those programs like VirtualBox.
 
Improvements to multiple repairs.
 
v2.8.3
New repair added "Repair Windows 'New' Submenu". When you right click on the desktop or in a folder and go to new and it is missing, empty or is missing the default items then this repair will put back the registry keys for the new menu and its default items.
 
Improvements to the Reset File Permissions. I have now made a tool to allow me to run the file permissions repair as the trusted installer. Before the only permissions it could set was anything with administrators or system as the owner. The only way to set the permissions on files that had the trusted installed as the owner was to take ownership of them. Well now that isn't needed as the repair can now set the permissions on those files as well :-)
 
Updated multiple repairs to no longer display everything in the cmd.exe window. When there is a lot of text to display in the cmd.exe window then it would use a lot of cpu to draw and update the cmd.exe window, which would slow down the repair since the cpu was being used to draw the window. By not showing all the text it cuts down on the cpu usage which helps increase the speed of the repairs.
 
Fix the monitors bars on the repair window to properly resize the bar picture when a user had their system dpi set above 100%. When it is above 100% everything increases in size in the program. The bars now take this into account.
 
Multiple interface changes.
 
v2.8.2
In the last update I had the Reset Registry Permissions no longer take ownership of the permissions but instead only tried to set the permissions, this was done to fix some rare odd variables on very very few certain systems but ended up not being a good idea. On systems that where infected, the viruses had changed the owner of the permissions in the registry and so since the program wasn't taking back owner ship, the permissions where not getting fixed. The program now takes ownership again for the registry permissions :-)
 
v2.8.1
Updated the Default Windows 8 Permissions to include Media Center and also the newest updates on patch Tuesday July 2014.
 
Added Default Windows 8 Permissions for C:\Program Files and C:\Program Files (x86). These are the defaults for the files and folders that are installed by default in Windows 8.
 
Added HKEY_USERS\.DEFAULT default permissions for Windows 8 to the Registry Permissions repair.
 
The Reset Registry Permissions repair now only sets the defaults on Windows 8 and doesn't modify any others. Windows 8 is to easy to break when it comes to permissions and simply resetting the default registry keys has been found to be the best option in my tests.
 
Fixed bug where log file couldn't be created when there was Unicode characters in the path.
 
Updated Repair Windows Update to include more fixes that help with the errors 0x80070643, 0x8007000B and 0x80071A91
 
v2.8.0
The program now auto takes a registry backup if the user didn't do one before hand. This is needed for the users who don't do a registry backup and then something doesn't go right and they cant restore. For now on the program will auto create it :-)
 
Updated the Reset permissions repairs for both files and the registry to restore the default permissions on Windows 8 after the permission repairs run. Now the repairs will update any new or custom files, folders and registry keys while putting the defaults back on all the standard default Windows locations. This new repair has stopped the app store from breaking because of permissions.
 
Major update the permissions repairs as well. The repairs no longer remove orphaned user accounts. It was this option that was causing so much headache in Windows 8 since windows uses unknown accounts for all their apps. Since the setacl.exe remove those unknown accounts it broke the apps. Reinstalling the apps will restore it and make it working again. The program will no longer remove these and this bug has finally been killed.
 
Since the program now auto creates a registry backup I have added a check box on the start tab that a user can uncheck if they don't want a automatic registry backup.
 
Updated Repair Windows 8 app store.
 
Multiple code changes and improvements across the whole program.
 
Multiple interface changes.
 
v2.7.5
I have written my own exe to run the repairs under the system account, replacing the 3rd party exe I was using. The tool I made is much smaller and I now can update it when needed :-)
 
UI changes and spelling corrections.
 
v2.7.2
Updated the Repair Windows Firewall. After helping a user whose firewall wouldn't start I found certain registry keys that where not part of the normal shared access service that where keeping the firewall from starting. Those registry keys are now removed if they are on the system.
 
Updated the program with a new icon and logo.
 
Updated the Registry Backup tool to v1.9.0
 
Small bug fixes.
 
Spelling Corrections.
 
v2.7.1
Multiple bug fixes. While I had updated the v2.7.0 setup and portable files with the bug fixes some download sites still had the bad files. 
So to make sure everyone gets updated I am putting out a new version. Make sure to use 2.7.1 :-)
 
v2.7.0
Added a new startup check to the program. The program will now check that all files needed for the repairs in the program folder are present.
If files are missing then the repair that needs those files will fail, which can cause bad side effects depending on the repair.
So now the program will do a quick check and if any files are missing, the program will let you know which files and ask you to reinstall the program to make sure all files are there.
You can not continue with the program if any files are missing. If all files are present then it automatically continues to the normal start window of the program.
 
Added a new repair "Reset Service Permissions" This repair will add permissions on all services on the current system. Administrators = Full, System = Full, TrustedInstaller = Full
 
"Reset Registry Permissions" & "Reset File Permissions" have been completely redone. The program was using subinacl.exe to set permissions but it was only 32 bit and didn't access the 64 bit locations.
This has been replaced with SetAcl.exe which supports 32 and 64 bits. So now on a 64 bit OS all areas get their permissions set.
Because this can now access all locations the 2 repairs are a little slower and it doesn't have the progress screen that the subinacl.exe did.
So the cmd window has been updated to not show what current key or file it is on as it slowed down the repair by a very very large amount because the CPU was being used to draw all the text to the cmd.exe window.
So by not having it display all that information the speed of the repair is much better.
 
Since "Reset File Permissions" now uses a new exe the exclusions part has been changed, if you used this option in the program please see the text files on how to use exclusions.
 
For Vista and newer versions of Windows "Reset Registry Permissions" & "Reset File Permissions" now also adds the "TrustedInstaller" account with Full access rights.
 
Updated multiple repairs to better handle Windows 8 and 8.1 and all the fussy stuff it wants, making the repairs better than ever for Windows 8 & 8.1 :-)
 
Updated other multiple repairs.
 
Improved the handling of the program running with the /silent switch and when it closes itself down after repairs.
 
Multiple code changes and improvements.
 
v2.6.3
Updated Repair Registry Permissions
 
Updated Restore Windows 8 COM+ Unmarshalers
 
The 2 repair updates both have to do with a bug that only hits a few Windows 8.1 users.
When the HKEY_CLASSES_ROOT\Unmarshalers permissions get changed and are not locked down then for some reason Windows deletes that registry key on reboot.
Only happens to certain machines and appears to be a bug in Windows. The repairs have been updated to now lock down the registry location like it was before,
this will stop the bug in Windows from the registry key from being removed.
When this registry key and its sub keys are removed the COM+ wont work and sound will stop working among a bunch of other things.
The Windows Repair Program didn't remove these, something in Windows does for a unknown reason. Now with that registry location being locked again it stops that from happening.
 
v2.6.2
Added a new repair "Restore Windows 8 COM+ Unmarshalers" Starting in Windows 8 the COM+ depends on a set of registry keys located under HKEY_CLASSES_ROOT\Unmarshalers\System
There is a bug in Windows 8 where those registry keys are sometimes removed, which when they are COM+ will no longer function and many things in windows stop working including audio, Windows Defender, Windows Firewall, WMI and many more.
When these keys are restored COM+ functions again. These registry keys where not in older versions of Windows and is new to Windows 8.
 
Updated Repair Registry Permissions
 
The tree view on the repair window now takes on the colors set for the text boxes and lists instead of the program back and text colors.
 
Changed the default color theme to make the text boxes and lists a little darker than pure white.
 
Updated Registry Backup to v1.8.0
 
v2.6.1
Multiple interface changes and fixes.
 
Code updates and improvements in multiple locations in the program.
 
v2.6.0
Added a new option to change all the program colors (under the settings tab). The user can now control the colors of the program and even save their color layout as a preset. This is very helpful for colorblind, or hard of seeing users or just users who don't like my default colors :-)
 
Added a new system monitor to the repair window. The repair window will now show the current memory usage, process count, cpu usage and current read and right speeds of the hard drives. This way a user can keep track if they are running out of memory or if the drives are doing anything during a repair. Very useful so the user can tell if a repair is working or has stalled.
 
There are now 5 step tabs before the repairs. I changed the Welcome tab to Step 1 and changed the order of the rest. On the new step 1 it tells the user to do a proper power reset before anything else and gives them a quick 4 step instruction on how to do so.
 
Changed the default colors of the program. Replaced the green text with a easier to read color. Also change the button colors to stand out more and multiple other changes.
 
A large amount of interface and layout changes.
 
Code cleanup, removed old code that I was no longer using.
 
Updated the code on step 3 when doing a read only chkdsk on the drive.
 
Updated the Register System Files repair.
 
Updated Restore Important Services.
 
Updated Repair WMI to make a backup of the antivirus, firewall and antispyware information. It will export that data out first since it is lost when WMI is built and then import it back in once WMI is finished. Normally the Windows security center would complain you have no AV install and such after the repair. The AV and such would update it self back to WMI after it updates itself or after another reboot. But this confused some users who thought their AV wasn't working. By exporting and then importing that information back will keep that from happening and confusing users.
 
Multiple Code improvements and changes through out the whole program.
 
v2.5.1
Important update to the "Set Windows Services To Default Startup" repair. A few services Windows changes the default startup for based on the hardware you have installed. Such as the wireless service is set to manual but if Windows detects a wireless card then the service is changed to automatic. The services that get changed have been updated and is now fixed.
 
v2.5.0
The "Reset File Permissions" Repair has been totally redone. The old way the program would run a bat file for each folder on the root of the drive. So if you had 100 folders on the root of the drive it would run 100 bat files in order to set the permissions on each folder. This was done so the program could skip certain folders. The repair now does the whole drive in just 1 bat file, making things much faster for this repair.
 
Also added a exclude list option to the "Reset File Permissions" Repair. This new excluded list will allow power users to tweak the repair and have it skip certain folders or files. This new option was what made it possible to streamline the repair. 2 new files where added to the files folder file_permissions_excludes.txt and file_permissions_profiles_excludes.txt.
 
Updated the "Repair WMI" to skip the system volume information folder when looking for wmi files to add back. Normally this wasn't a problem but if for some reason a user had taken ownership over the system volume folder then the program had access to it and then the WMI repair would loop through the restore points, which we don't want.
 
The "Set Windows Services To Default Startup" has been redone as well. Before it pulled what services to set from the services_startup.txt file in the files folder. With Windows having so many different services for each version of Windows I have now made the repair pull from a txt file based on what version of Windows the user is on. This now gives even more control to power users and also makes the repair better suited for each version of Windows. 5 new files have been added to the files folder services_startup_xp.txt, services_startup_vista.txt, services_startup_7.txt, services_startup_8.txt, services_startup_8.1.txt.
 
To help make the "Set Windows Services To Default Startup" even better I installed a fresh copy of Windows XP Pro SP3, Vista Ultimate SP2, 7 Ultimate SP1 , 8 Pro and 8.1 Pro with nothing added to them but their default installs and pulled all the service startup information for every single service. The repair now sets more services than ever and as of right now every known service default in each version of Windows.
 
Multiple other code changes and improvements.
 
v2.4.2
The step 3 system file checker cmd.exe window now uses the cmd color options in the program.
On step 2 I added a view log button that will show up after you run check disk on the system, the log file is stored in the log file location but now the user can open it right from the program if they wish.
Added a "View Logs" button to the main repair window. Now users can open the logs folder after doing repairs instead of manually going to them, this will help with users who have trouble knowing where the logs are.
Bug fix for VSS and services for XP systems.
 
v2.4.1
Fixed bug in the program where if you ran the Repair CD/DVD and had iTunes installed iTunes could complain about a regkey missing. The program did put the registry key back into the registry but it didn't null terminate the line so iTunes still complained. This has now been fixed and iTunes no longer complains.
Reset File Permissions has been improved. The reset file permissions normally skips the profile folders on the system. This was due to a odd bug in Windows Vista, 7 and newer where if "Everyone" permissions was set on a folder under the user profile Windows would think it is shared when it wasn't. Well after helping a user who had a lot of problems on their system it turned out to be because somehow the user had removed "Administrators" and "System" from all the permissions on the folders and files of the profile. Once those where put back everything worked. So I knew I had to get the profiles added to the repair. The new changes will update all the profile folders properly and only add administrators and system, not everyone. Also for the current user profile folder it will also add the current user as it should be that way.
Small code changes.
 
v2.4.0
Repair Icons has been updated and redone. The repair will now kill explorer.exe to unlock the cache files, delete them and then start explorer.exe back up. Also Starting with vista, 7 and 8 there is a new location for the cache files and that has been added to the repair.
Change the the logs, the program now makes a folder with the date and time the start repairs button was clicked and logs are stored in that folder in the log location. So now instead of the program overwriting logs it now keeps them so you can view logs from different repair runs.
Added a new tab in the main window of the program letting users know about tweaking their system for performance after a repair. It simply tells them about my simple system tweaker and my CleanMem tool from my other site PcWinTech.com. This way users now have an option to try and speed things up afterwards if they like.
I have made a custom CleanMem for Tweaking.com and included it with the program. The program will now cleanup memory on the system instantly before doing the repairs. This will help with systems with little memory or have some processes that are memory hogs or have memory leaks, they get cleaned up before the repairs start.
Updated Repair WMI.
Updated Repair IE to support IE 11.
Program now pulls more system information and adds it to the logs, this has the benefit of letting the user see how memory and other things look and the information can also help when helping a user in the forums.
Added 20 more services to Restore Important Windows Services.
Multiple code changes and updates.
The installer for the program now puts the setup log in the same folder as the program instead of the temp folder. This will make it easier for users to find it if they wish.
 
v2.3.0
Fixed a bug where the cmd.exe windows where not changing color like they use to.
New feature, you can now set what back and text color to use in the cmd.exe windows. This is useful when running the program from a script and you can tell which cmd.exe windows belong to the program and not the script.
Program now gives a warning if it is unable to create the log file path. If the program is unable to save the log files the repairs will fail. Examples of it failing would be if the path has Unicode chars or is pointing to a ready only folder such as running off a cd.
Small bug fixes and multiple code changes.
 
v2.2.1
Per user request I have enabled the beta repair for system restore.
Adjusted privileges of the program to fix a loop in the wmi repair and to also give better access for the repairs.
Program now logs if it has trouble loading needed privileges. This can be helpful if the user account the program is running under doesn't have the correct access that is needed for the repairs.
 
v2.2.0
Remove beta repairs button. The only beta repair was for the system restore which wasn't repairing it, so no point in having it till i find more info on it :-)
The Repair CD/DVD Missing/Not Working now logs if it detects iTunes and if it does it applies the upperfilter regkey so iTunes can burn cds.
The Unhide Non System Files now also sets the show desktop icons back to enabled. Some viruses are putting desktop icons as hidden. If you keep them hidden your self you can rehide them with a simple right click on the desktop and then go to view.
Updated the repair windows firewall to have file and print sharing enabled.
Add a "Defaults" button next to the select all and unselect all repairs. This was by user request. The defaults button will select the default repairs, the same as when you run the Windows Repair for the first time.
The Windows Repair log now record system information such as what version of windows and such. This way when a user posts the log in the forums and doesnt tell me what version of Windows they are on I can see it in the logs.
New repair added for Windows 8 users. Repair Windows 8 Component Store. Microsoft finally added some built in tool to fix and recover corrupt files when sfc /scannow fails and says it couldn't fix some corrupt files. I also have the repair do a cleanup of the component store to shrink the size and also possibly remove errors from old outdated files. Here is the repair info from with in the program.:
 
"Repair Windows 8 Component Store
 
The following commands are done.
 
Dism /Online /Cleanup-Image /StartComponentCleanup
Dism /Online /Cleanup-Image /RestoreHealth
 
The first command cleans up the component store (WinSxS Folder) in windows, reducing it size and removing old entries.
 
The 2nd command is used to repair corrupt files and corrupt entries in the component store.
 
Reasons for this repair:
Used to fix Windows component store corruption when a SFC /SCANNOW command is unable to repair corrupted system files because the store (source) is corrupted, then run the SFC command again.
Used to fix Windows component store corruption when the same Windows Updates continue to appear to be available to install even though they already show successfully installed in update history.
 
More information on these commands can be found here:
and
"
 
v2.1.1
New feature added to the program (Possible speed increase as well). Under the settings tab in the main window of the program you can now set the window state and priority of the cmd.exe. The program uses bat files to run the repairs which goes through cmd.exe in Windows. Now you can choose to have the cmd.exe window be minimized, maximized or normal like it has been. (Useful for techs who are running repairs but are trying to do something else on the system) You can also set what CPU priority to run cmd.exe, so on older systems where the CPU is in use by other processes the cmd.exe window can now get priority, thus getting more CPU when it needs it and possibly speeding up the repairs for some people.
Updated and improved the Repair Winsock & DNS Cache
Updated and improved the Repair Windows Updates.
Multiple small code changes.
 
v2.1.0
Added new repair "Repair Windows App Store"
Updated Registry backup to 1.6.8
The program now auto skips repairs that are meant for a different version of Windows.
Added a checkbox to give the user an option to not have the program check for updates at startup. While I didn't have this before as it is extremely important to always run the latest version because of bug fixes and changes, it also causes the program to hang for a few seconds if the computer it is running on cant access the site to see what the current version is. So now the user can turn that off.
 
v2.0.1
Fixed bug where the /silent command didn't work. The bug was when you used /silent the repair window would show but didn't run the repairs. This is because with the new interface the treeview of the repairs wasn't loaded yet, so it didn't see any repair to run. This bug has now been fixed and /silent works again :-)
 
v2.0.0
New interface. Still the same layout but new colors that match the same look and feel as other programs on tweaking.com
Due to the interface changes I changed controls and graphics to make a smaller exe, smaller setup and use less memory.
Code improvements to Repair WMI.
All new logging. The program now records any output from the cmd.exe, not just errors. Bigger log files, but much better information when needed.
Support for Windows 8.1 added.
Tons of Code changes.
Repair Windows Updates updated.
Repair WMI updated.
Restore Important Windows Services updated.
Multiple bug fixes from the last version have been fixed.
 
v1.9.18
Bug fix: The program would get stuck in a opening and closing loop when you had it set to auto restart after repairs. This was because of a timer not turning off and wanting to update the window while it was closing down, thus the loop. This has now been fixed and the program closes like it should.
 
New feature: Since I had to get this bug fixed quickly I decided to take the time to add a new feature I came up with. In the steps before the repairs, Step 2 asks the user to do a check disk (chkdsk) on the system to make sure there is no file system errors before doing any repairs. I hated the fact that I forced the user to reboot to scan it when there may not be any errors on the file system. So I have added a new option to this step where the program will check the drive for errors and let you know if any are found. It is done by making a pipe to a cmd.exe window and running chkdsk in read only mode. Once chkdsk is done it looks for the key words "Windows found problems" and can let the user know if running chkdsk is even needed. Thus saving the user a reboot if there are no errors. I also have it log the chkdsk results to a chkdsk.log file in the logs folder in case a user wants to see the results of the chkdsk. :-)
 
v1.9.17
Updated the repair list to be numbered. This way when others have users use the program they can tell them what number in the list to choose instead of the repair name, making it easier for the user to check the correct ones.
Unhide non system files has been updated to support Unicode systems and file names and also to skip folders and files with symbolic links so it doesn't get stuck in a loop.
Unhide Non System Files now logs all files it unhides.
Repair WMI has been updated to apply MOF and MFL files back into WMI. So if you have a 3rd party program that added themselves to WMI they will be added back.
Log files have been updated to make a log file for each repair instead of trying to put everything into one log file. This is because the cmd.exe would sometimes give an error on the log file being in use.
Program now deletes old log files before running repairs. This way the log files dont keep growing in size if repairs are ran more than once.
Reset Registry Permissions has been enabled for Windows 8, but only does sections of the registry that doesn't effect the app store.
Repair Windows Firewall has been updated to use subinacl.exe to set the reg permissions instead of regini.exe. That is now 2 less files needed in the program.
Multiple code changes.
 
v1.9.16
Update to the Reset File and Reset Registry permissions. These repairs now delete orphaned SIDs and no longer follows symbolic links, keeping it from getting stuck in an infinite loop.
Updated the Repair Important Services to apply reg permissions to the service section in the registry (In case the reg permissions repair was skipped, and for users on Windows 8 who can't user the reg permissions repair because of the Windows App store.) and also to remove symbolic links from the Windows defender folder in case a well known virus put those there to break Windows defender.
Added remove_symbolic_links_from_windows_defender_folder.bat file to the files folder. This can be used by users who simply need to remove the symbolic links a virus puts on the Windows defender folder to keep Windows defender from working. The program now does this as well, but I decided to add a file for it for advanced users. The program doesn't not use this file, so changing it will have no effect on the program.
When a new update is available the program will now tell you in the caption bar instead of only at program startup. This is good for users who missed the message that there is a new version.
 
v1.9.15
Change the scan of malwarebytes from full to quick. Full is normally needed when scanning external drives and such and a quick scan is meant for scanning your system for all known malware locations and is much faster.
Small code changes.
 
v1.9.14
The awesome guys over at Malwarebytes gave me permission to allow Tweaking.com - Windows Repair to download and install Malwarebytes Anti-Malware and start a scan right from the program. This will now help make things a little easier for novice users and is a few less steps that my fellow techs need to do. When you start the program the scan option is on "Step 1" and is totally optional :-)
 
v1.9.13
Added msiserver service "Restore Important Windows Services" and "Repair MSI (Windows Installer)"
Added sppsvc service to the "Restore Important Windows Services"
Improved "Repair Internet Explorer", now better supports IE6 to IE 10.
"Repair Internet Explorer" now loads the list of files to register from the ie.txt file in the files folder. This gives users more control if they need it.
Improved "Repair MDAC/MS Jet"
"Repair MDAC/MS Jet" now loads the list of files to register from the mdac.txt file in the files folder. This gives users more control if they need it.
 
v1.9.12
Added 4 more service repairs to the "Restore Important Windows Services".
Improved repair print spooler.
Moved "Set Windows Services To Default Startup" to the bottom of the list. Since you can edit the file of what services are set to what startup, it made sense to move this last since other repairs that restore services put them back to their startup as well. This way a person can edit this file to keep any tweaks they have done to their services on the system.
Minor bug fixes and code changes.
 
v1.9.11
Improved "Repair Windows Update". On a very few machines the repair was unable to rename the pending.xml file. On vista and 7 this would cause the "installing update step 3 of 3" screen to never go away at boot up. By simply renaming the pending.xml file fixed this. Even though this was already part of the repair, if the file was in use at the time then it wasn't able to be renamed and the person would get stuck at the next boot. I am changed the repair to now remove any attributes from the file and set a secondary rename option directly in the registry to have windows rename the file at boot up. So now if the repair is unable to rename that file during the repair it will get rename at the next system boot. Hopefully this will now keep the "installing update step 3 of 3" screen from coming up and getting stuck. I was able to replicate this problem in Windows and the new repair fixed it in my testing.
 
Improved the "Repair Winsock & DNS Cache". The repair reset TCP which would also clear any static IP info set on the system. Per user request the program will now extract the static IP info, run the repair and then put the static IP info back.
 
v1.9.10
Improved the "Repair Windows Firewall". The program use to only restore the core of the shared access service. It didn't put any policies or rules. While helping a user in the forum they had a virus completely delete the shard access service key, including all rules. When the shared access was put back the firewall worked but he was unable to share any files. This is because there is some core things that have to be in the firewall rules in order to work. I have now added those core rules to the repair and it got his file sharing working just fine. This now makes the repair even better than before.
 
Added some more settings for the "Repair Windows Firewall". While helping a user in the forum the firewall was working but he couldn't get the firewall to open and would get a Group Policy error. While helping him I found the 2 reg keys that where needed to fix it. This keys are only on Vista and 7. They are not on Xp, 2003 or 8. The repair now puts these keys in on Vista and 7 only.
 
Added Windows Defender to the "Restore Important Windows Services" repair.
 
v1.9.9
Fixed bug reported by users where a folder was created on the C: drive called "Program" and windows would ask to delete or rename it, which was safe to do. The bug was with the new log settings. Bat files do not like spaces. If there was a space in the log location name it made that folder and the log was never made. The fix is to just make sure that the path is started and ended with quotation marks. I have updated all 250 locations in the program to make sure the log path has the quotation marks. This bug is now fixed.
 
v1.9.8
Changed the "Set Windows Services To Default Startup" repair to pull the services startup from a text file in the files folder instead of being hard coded. This will let users tweak this repair if they wish.
 
The program will now keep Windows from going into sleep mode or hibernation when repairs are running.
 
Added new repair "Repair Print Spooler"
 
Added "Time Elapsed" to the repair Window, so now users can see how long the repairs have been running.
 
Add new settings tab to the main window.
 
Under the new settings tab you can now change the default location for the log files.
 
Changed the default location of the log files from the Windows drive to the Logs folder in the program folder.
 
Added new repair "Restore Important Windows Services", this repair will replace all the services that the other repairs do. And as time goes I will add more services to this repair.
 
v1.9.7
Major changes to both "Reset Registry Permissions" and "Reset File Permissions". I found out that if you where on a non English system these two repairs simply wouldn't run and thus not change any permissions. This was because it was settings the permissions based on the names such as "Administrators" or "Everyone". On non English systems these are spelled differently and so would fail. I have changed these two repairs to set it by SID now instead of name. Example: Instead of "Administrators" it will use "S-1-5-32-544" (Which is the Windows Default SID for Administrators). These two repairs will now work on non English systems. As an added bonus, the two repairs run much faster now. The reason why is when I was using the names instead of the SID it had to go and lookup the SID of the names. Now that I am using the SID from the start it no longer has to do that lookup, thus making it run nearly twice as fast or better :-)
 
Fixed bug where if you opened the repair window, then closed it and then went back to it the repairs wouldn't work. This is because the program though it was in close down mode from closing the repair window. This has now been fixed.
 
Program now shows how many repairs are selected above the repair list. Example: "Repair Options (Selected: 10 of 35)"
 
The repair wmi was done in 3 steps to simply give a progress of what it is doing. Instead I have combined the 3 steps into 1.
 
Unhide none system files now gives a count of how many files it unhides. Also made a new status window to show when the unhide repair is running.
 
The Beta Repairs button will now be disabled when your running repairs.
 
The program now lists all fixed drives in the system for the Reset File Permissions and Unhide Non System Files repairs. Before it would only do the drive that Windows is on, now you can have it do other fixed drives as well. By default only the Windows drive is selected.
 
Log window now shows when a repair is being ran under the system account and the current user account.
 
The cmd.exe windows now show what repair it is doing in the title bar.
 
The program now checks if it is being run from a network path. If it is it lets the user know that due to Windows network security most repairs will fail and to please run the program locally on the system.
 
v1.9.6
Added renaming of the pending.xml file to the Repair Windows Updates
 
Due to an odd bug with the Windows 8 app store I had to disabled the reset reg permissions repair for now for Windows 8 systems. For some reason even though the app store has permissions, if you change the permissions in any way under certain keys under hkey local machine the app store will refuse to install apps and give the error code 0x8007064a. Until I can find out what keys the app store doesn't like touched I will keep this repair disabled for Windows 8.
 
v1.9.5
Fix bug where the program wouldn't go to the next repair if a cmd.exe was open. That means when the program was run from a bat file it wouldn't move forward. This bug was caused from a previous update. This is now fixed.
 
Updated the "Set Windows Services To Default Startup"
 
v1.9.4
On some systems, depending what programs are installed would not leave enough system resources for the reg and file permissions repair. On these systems after those repairs the rest of the repairs wouldn't work because the system was out of resources. There are two simple reg tweaks that increase the system resources Windows will use. Both repairs will now apply those two reg keys. Not only will this fix the resources being used up but should also fix any other program that runs out of resources. A reg file for these two tweaks are in the files folder with the program.
 
Added more files to the repair system restore.
 
Nearly all repairs run under the system account. As I work on the repairs I noticed something odd. Some parts of the repairs work when run under the current user account and fail under the system account, and other parts fail under the user account and work with the system account. Such as adding reg files or registering files. Here is an example registering the file blb_ps.dll under the user account works while trying to register it under the system account fails, and this only happens with a few files while the rest work fine under both. To handle this I now have some of the repairs run twice, once under the user account then again under the system account. This should handle any odd permissions between the two accounts and insure that the repairs are successful. This isn't needed on all repairs.
 
v1.9.3
Added a new section to the program called "Beta Repairs". There is a button on the repair window that will open it for you.
Added new beta repair "Repair System Restore" this is for Windows Vista, 7 and 8. Microsoft has no repair info on the system restore. So I monitored what services and files the system restore needs and I am working on the first known system restore repair. This is in the beta section till I get user feedback on how it works and if it gets system restore working again for people.
 
v1.9.2
Per user request the main repair window is now resizable.
Added 11 new file association repairs. What makes these repairs different than just clicking a reg file is on vista and newer some of the keys are locked. Since the program runs the repairs under the system account these repairs have access to those locked keys.
Added a "Tips" button that loads a page on the site with some tips on which repairs to run and tricks you can do with the program.
Changed the list in the program to a treeview.
I have some repairs unchecked by default now instead of all repairs checked.
Many code changes.
 
v1.9.1
Changes to the user interface.
 
v1.9.0
Minor Interface changes.
Program now pulls the information of each repair from a txt file instead of being directly in the program.
Added the BITS service to the Repair Windows Updates.
Added the wuauserv service to the Repair Windows Updates
Added a few more things to the Repair Windows Updates.
Added more support for Windows 8 repairs.
Added more dll files to the register system files repair.
Added new repair - "Repair Windows Safe Mode". This will put the default reg keys in order to boot into safe mode. Some viruses remove these reg keys. This will simply put the defaults back and allow safe mode to boot again.
Added more to the "Remove Policies Set By Infections" repair.
Multiple Code changes and improvements.
 
v1.8.0
Replaced Erunt registry backup with Tweaking.com - Registry Backup
Some new viruses have been adding programs to the Image File Execution Options in the registry. Keeping those programs from running. I have added 773 more items to the Remove Policies Set By Infections.
Added new repair "Repair Windows Snipping Tool". This will run on vista or newer and replace the reg keys needed for the snipping tool.
Added new repair "Repair .lnk (Shortcuts) File Association" This will run on vista or newer.
Updated the "Repair CD/DVD Missing/Not Working" to see if iTunes is running (Looks for ituneshelper.exe is running). If it is it puts the iTunes "UpperFilters" for the cd/dvd rom drive so iTunes wont give the error "Warning the registry setting used for importing CD are missing". More info here http://support.apple...iewlocale=en_US
Multiple code improvements.
 
v1.7.5
Improved operating system detection code. What does this mean? Some repairs need to know what version of Windows it is running run to run the correct code. The program used WMI to pull this info. But if WMI was broken it didn't pull the info. I now have it use the Windows API to pull the Windows version, and if for any reason it fails it will fall back to using WMI to pull the info.
 
v1.7.4
The program is now Terminal Server Aware. When you ran the program on a Windows server that had Terminal Services installed the Windows API returned the wrong path to the windows dir. This is now fixed.
 
v1.7.3
Updated the Repair Windows Firewall. It now restores the reg keys for the BFE, MPSSVC and WSCSVC services. Before it only put back the shared access service. Which in XP is all the firewall needed. But in Vista and 7 it required more services. They are now part of the repair :-)
 
v1.7.2
Small bug fixes to the log creation of the program.
I have removed the 3 options "Basic" "Advanced" and "Custom" before you start the repairs. Nearly all users that I have talk to, and myself included always choose custom anyways. No need for these other options and they have been removed. Should cut down on the confusion for new users on which to use.
New interface changes to the repair window in the program.
Added "Always On Top" option for the repair window.
Added a minimize button to the repair window. With the always on top option if something opens behind the window and the user needs to get to it they can now minimize the window.
Added a minimize button to the main window in the program for the heck of it :-)
Code improvements.
 
v1.7.1
Updated the Repair WMI to better handle the commands needed for the different version of Windows. While the WMI works great on XP, Vista and 7 it didn't work correctly on 2003 thus breaking WMI. I have added the commands need to have it run properly on 2003 :-)
 
v1.7.0
Small improvements to a few repairs.
Better support when running the program through a script. I have a good amount of repair shops that use this repair tool. Some like to run the repair tool with the silent command and from a script in a bat file. The old version of the program would close any cmd.exe window before running the repairs. This of course defeated the purpose of running through a script. So I have changed the way the program waits for a repair to finish. Instead of waiting for cmd.exe to close, each repair will now make a file. When the repair is finished it will delete the file, then the program will know to move onto the next repair.
I now have the cmd.exe windows change to a gray background with black text. This way when running the program through a script you will know which cmd.exe window belongs to the windows repair :-)
The program will now save any errors from the repairs into a txt file on the Windows drive in a folder. Example: "C:\Tweaking.com_Windows_Repair_Logs\" Multiple log files are made for the permission repairs. This is because the MS tool doesn't append to the log file, so a new file has to be made for each section. Since this could create a fair amount of log files I have the program cleanup any empty log files after the repairs are ran.
 
v1.6.5
Program detects if you are running in safe mode and warns that some repairs may not work in safe mode.
I have also made a few changes for all repairs to run better in safe mode. No guarantees but should definitely run better in safe mode than it has before.
Per user request you can now choose to restart or shutdown the computer after repairs.
I have the repair window resized to 750 x 550 pixels (Now bigger than before). This is the max size to fit on the screen in safe mode which is normally 800 x 600.
 
v1.6.4
Add ERUNT Registry backup tools. This is another option to backup the system registry before doing repairs. Also very helpful when a users system restore isn't working properly.
 
v1.6.3
Major improvement for the Reset File Permissions repair. On vista and newer the repair would allow access to folders windows normally blocked. Such as "C:\ProgramData\Application Data". Normally with this folder you would get an access denied. After you ran the reset file permissions repair you could access it. The side effect was that this folder points back to the C:\ProgramData folder. So it made an endless loop! The repair now checks if your on anything newer than XP. If you are then it runs a batch of commands after the repair that puts back the deny permissions on all the folders that are supposed to be blocked. This stops that endless loop from happening. 46 folders total. :-)
 
v1.6.2
Per user request I have added a silent command option to the program. Set the options in the setting.ini file and run the program with /silent. The program will run in custom mode running the repairs set in the settings and then close it self. Will even reboot when done if set in the settings. (Perfect option for my fellow network admins) :-)
Small code changes.
 
v1.6.1
Added new repair "Repair Missing Start Menu Icons Removed By Infections" This repair will put back the missing icons in the start menu, quick launch, and desktop that are moved by a rogue virus.
 
v1.6.0
Added new repair "Repair MSI (Windows Installer)"
Added exe fix (when a virus hijacks the exe section in the registry) to the "Remove Policies Set By Infections" repair.
Improved "Repair Windows Updates".
Small interface changes.
 
v1.5.8
Bug Fix: I found a very odd bug where some of the repairs were not working right. All repairs run under the system account (because of the trusted installer in vista and newer). For some reason the repairs that set registry keys by a .reg file and with regedit would run but the changes wouldn't take. The fix was to have those repairs run as the logged in account. Still scratching my head on that one, but at least now they work again :-D
Bug Fix: The repair windows firewall wasn't running all the repairs needed for it. This has now been fixed.
The Reset File Permissions now skips the "Users" folder in Vista and newer and "Documents and Settings". The reason for this is in Vista and newer there is a bug where if the file permissions are changed in the user profile then Windows thinks the file is shared when it isn't and you get a shared icon on it. More information is here http://www.tweaking....topic,69.0.html
Small code improvements.
 
v1.5.7
Changed Windows Image Acquisition (WIA) from "stisvc start= demand" to "stisvc start= auto" in the windows services repair.
 
v1.5.6
The "Remove Policies Set By Infections" repair wasn't working properly. The commands where deleting the Reg file before it had been applied. I added the start /wait command to the regedit. "Remove Policies Set By Infections" Now works correctly :-)
 
v1.5.5
Removed "WwanSvc start= demand" from the windows services repair.
The program no longer defaults to the C:\ for repairs. The program now looks at the location of the Windows dir and uses the drive that Windows is on.
 
v1.5.4
On users machines who's "Path" variable was corrupt none of the repairs would work. To fix this I have added "set path=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem" to all the repairs. Now on users systems with a corrupt "path" variable the repairs will still work properly :-)
 
v1.5.3
Changed 4 service defaults from manual to auto in the set services to default startup repair. Media Center Receiver Service, Media Center Scheduler Service, Windows Media Center Service Launcher and Windows Media Player Network Sharing Service.
Removed Panda cloud antivirus from the program and put Avast as a recommendation (Step 2 Window).
Added ComboFix to the recommendation page (Step 2 Window).
 
v1.5.2
Interface changes.
 
v1.5.1
Blackvipers site listed the Windows 7 wireless service startup state as manual. But when it is set to manual it will not start and thus the user has no wireless. I have updated the services startup repair tool to put the wireless to auto instead of manual.
 
v1.5.0
Added a new repair "Set Windows Services To Default Startup". (Currently 194 services) This will set the Windows services to their default startup state. Special thanks to http://www.blackviper.com/ for having all the default information handy. This will set the services startup by the "sc config" command and not by the registry. The information on the repair in the program lists all the services that are set.
 
1.4.3
The new setup file for the program was missing some of the repair files it needed. The setup has been updated and I made this new version so people who downloaded the last version will update and get the rest of the files they need.
 
1.4.2
Removed moving arrow from the repair window. Since the list of repairs is growing and the list is scrollable the arrow didn't work well.
In a past update I removed the custom buttons because they would cause the program to crash. The program then used the default old ugly buttons. I have made a new button control and updated the buttons so they look better, and it doesn't cause the program to crash like the old ones.
Program now asks the user if they want to create a restore point before doing repairs if they didn't have the program create one.
The program now comes in a setup program and the portable version. The new setup is larger because it contains the VB6 SP6 runtimes the program needs in case they are corrupt on the system that is being repaired.
More Code tweaks and changes.
 
v1.4.1
Added more files to the register system files repair that will fix "Class not registered" when trying to open a .mmc file. Such as Task scheduler, Device Manager, Computer Management and more.
Program now starts the Windows Sidebar after the Windows Sidebar repair.
Removed the security zones in IE being reset with the sidebar repair.
More code tweaks and improvements.
 
v1.4.0
Removed the custom buttons from the program. It was causing the program to crash on some systems. Program is meant to repair, not look pretty, so ugly standard safe buttons it is :-)
Add new repair "Repair Windows Sidebar/Gadgets"
Changed the window size of the repair window, making it smaller and easier to fit on screen for smaller resolutions.
More code tweaks.
 
v1.3.1
Minor GUI and code Tweaks.
 
v1.3.0
If you ran an older version of this repair program and it caused problems on your system, download and run this version and it will fix any problems it caused :-)
Added new repair "Repair Volume Shadow Copy Service"
Major update to the program making it safer and better at repairs. Make sure to use this new version and not the old versions.
 
v1.2.0
Per user request - Added a new repair "Repair CD/DVD Missing/Not Working"
Fixed bug where when repairing WMI the WMI tester would open and the program wouldn't move forward till the WMI tester was closed. Most users didn't know to close this. I have made the program now look for and close the WMI tester if it pops up during the WMI repair.
 
v1.1.1
Remove some files from the Register System Files repair. While this repair worked great on a lot of some systems on a few ones it would create more problems. The repair now has a much smaller list of only known good files to register.
Updated Repair IE section.
Updated Repair MDAC Section.
 
v1.1.0
Major changes to how the program launches the repairs. It now shows the command window doing the repair in the task bar. Also should work better with the UAC enabled and running the commands as administrator. This will also keep the program from not responding during repairs.
Updated the file permissions repair to include everyone and users full rights. It use to do just Administrators & System. But on some machines they needed more to get things working right again. This should fix that.
Replaced some of the controls in the program so the program & zip file is smaller in size.
 
v1.0.2
Fixed bug in Repair WMI (Hopefully got it this time)
Added link to help fix any problems someone might have with the file permissions repair.
 
v1.0.1
Fixed bug in Repair WMI
GUI Changes.
 
v1.0.0
First Release
 
[08/17/2014 09:20:10] Success Setup started: C:\Users\Owner\Downloads\tweaking.com_windows_repair_aio_setup.exe
[08/17/2014 09:20:10] Notice Setup engine version: 9.2.0.0
[08/17/2014 09:20:10] Notice Product: Tweaking.com - Windows Repair (All in One), version 2.8.6
[08/17/2014 09:20:10] Success Language set: Primary = 9, Secondary = 1
[08/17/2014 09:20:10] Success Verify archive integrity
[08/17/2014 09:20:10] Skipped Date expiration check
[08/17/2014 09:20:10] Skipped Uses expiration check
[08/17/2014 09:20:10] Success System requirements check
[08/17/2014 09:20:10] Success Include script: _SUF70_Global_Functions.lua
[08/17/2014 09:20:10] Notice Start project event: Global Functions
[08/17/2014 09:20:10] Success Run project event: Global Functions
[08/17/2014 09:20:10] Success Detection Script: Visual Basic 6.0 (SP6)
[08/17/2014 09:20:10] Info VB6 SP6 Module: Current version of msvbvm60.dll detected. The VB6 SP6 runtime is already installed.
[08/17/2014 09:20:10] Skipped Dependency file: C:\Users\Owner\AppData\Local\Temp\_ir_sf_temp_0\vb6sp6\VBRun60sp6.exe (Reason: Dependency Detection Passed)
[08/17/2014 09:20:10] Notice Start project event: On Startup
[08/17/2014 09:20:10] Success Run project event: On Startup
[08/17/2014 09:20:10] Success Display screen: Welcome to Setup
[08/17/2014 09:20:41] Success Display screen: Select Install Folder
[08/17/2014 09:21:26] Success Display screen: Select Shortcut Folder
[08/17/2014 09:22:02] Success Display screen: Ready to Install
[08/17/2014 09:22:12] Notice Start project event: On Pre Install
[08/17/2014 09:22:12] Success Run project event: On Pre Install
[08/17/2014 09:22:12] Success Display screen: One Progress Bar (While Installing)
[08/17/2014 09:22:12] Success Free space check on drive: C:\
[08/17/2014 09:22:12] Success Set uninstall data folder: C:\Users\Owner\Desktop\Uninstall
[08/17/2014 09:22:12] Success Set uninstall config file name: C:\Users\Owner\Desktop\Uninstall\uninstall.xml
[08/17/2014 09:22:12] Success Uninstall config file not merging
[08/17/2014 09:22:12] Success Create folder: C:\Users\Owner\Desktop\Uninstall\
[08/17/2014 09:22:12] Success Create uninstall data folder: C:\Users\Owner\Desktop\Uninstall
[08/17/2014 09:22:13] Success Create uninstall data file: C:\Users\Owner\Desktop\Uninstall\uninstall.dat
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\changelog.txt
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\changelog.txt
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\msinet.ocx
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\msinet.ocx
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\Repair_Windows.exe
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\Repair_Windows.exe
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\Repair_Windows.exe.manifest
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\Repair_Windows.exe.manifest
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\settings.ini
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\settings.ini
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\fix_exe_hijack.inf
[08/17/2014 09:22:13] Success Create folder: C:\Users\Owner\Desktop\files\
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\fix_exe_hijack.inf
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\system_files_reg_list.txt
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\system_files_reg_list.txt
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\bfe.reg
[08/17/2014 09:22:13] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\
[08/17/2014 09:22:13] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\7\
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\bfe.reg
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\mpssvc.reg
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\mpssvc.reg
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\wscsvc.reg
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\wscsvc.reg
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\bfe.reg
[08/17/2014 09:22:13] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\vista\
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\bfe.reg
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\mpssvc.reg
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\mpssvc.reg
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\wscsvc.reg
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\wscsvc.reg
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\wscsvc.reg
[08/17/2014 09:22:13] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\xp\
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\wscsvc.reg
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\policy_cleanup.txt
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\policy_cleanup.txt
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\change_log.txt
[08/17/2014 09:22:13] Success Create folder: C:\Users\Owner\Desktop\files\registry_backup_tool\
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\change_log.txt
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\data.dat
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\data.dat
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\MSINET.Ocx
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\MSINET.Ocx
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\Settings.ini
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\Settings.ini
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\SSubTmr6.dll
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\SSubTmr6.dll
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\TweakingRegistryBackup.exe
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\TweakingRegistryBackup.exe
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\TweakingRegistryBackup.exe.manifest
[08/17/2014 09:22:13] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\TweakingRegistryBackup.exe.manifest
[08/17/2014 09:22:13] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\tweaking_com_treeview.ocx
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\tweaking_com_treeview.ocx
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\vbalIml6.ocx
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\vbalIml6.ocx
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\dosdev.exe
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\files\registry_backup_tool\files\
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\dosdev.exe
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\recovery_console.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\recovery_console.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_2003.exe
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_2003.exe
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_pause.exe
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_pause.exe
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_start.exe
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_start.exe
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_start.exe.manifest
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_start.exe.manifest
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_vista_32.exe
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_vista_32.exe
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_vista_64.exe
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_vista_64.exe
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_xp.exe
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_xp.exe
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\remove.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\remove.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\bits.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\bits.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\safeboot.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\safeboot.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\wuauserv.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\wuauserv.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\bfe.reg
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\8\
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\bfe.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\bits.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\bits.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\mpssvc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\mpssvc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\safeboot.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\safeboot.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\wscsvc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\wscsvc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\wuauserv.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\wuauserv.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\bits.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\bits.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\safeboot.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\safeboot.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\wuauserv.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\wuauserv.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\safeboot.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\safeboot.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\wuauserv.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\wuauserv.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Register System Files.txt
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\repairs_info\
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Register System Files.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Remove Policies Set By Infections.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Remove Policies Set By Infections.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Remove Temp Files.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Remove Temp Files.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair CD_DVD Missing_Not Working.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair CD_DVD Missing_Not Working.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Hosts File.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Hosts File.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Icons.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Icons.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Internet Explorer.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Internet Explorer.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair MDAC_MS Jet.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair MDAC_MS Jet.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair MSI _Windows Installer_.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair MSI _Windows Installer_.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Proxy Settings.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Proxy Settings.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Volume Shadow Copy Service.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Volume Shadow Copy Service.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows Firewall.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows Firewall.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows Safe Mode.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows Safe Mode.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows Sidebar_Gadgets.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows Sidebar_Gadgets.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows Snipping Tool.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows Snipping Tool.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows Updates.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows Updates.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair WMI.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair WMI.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Reset File Permissions.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Reset File Permissions.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Reset Registry Permissions.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Reset Registry Permissions.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Set Windows Services To Default Startup.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Set Windows Services To Default Startup.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Unhide Non System Files.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Unhide Non System Files.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\_Readme.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\_Readme.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\bat.reg
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\file_associations\
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\bat.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\cmd.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\cmd.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\com.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\com.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\dir.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\dir.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\drive.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\drive.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\exe.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\exe.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\folder.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\folder.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\inf.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\inf.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\lnk.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\lnk.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\msc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\msc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\reg.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\reg.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\scr.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7\scr.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\bat.reg
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\bat.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\cmd.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\cmd.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\com.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\com.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\dir.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\dir.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\drive.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\drive.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\exe.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\exe.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\folder.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\folder.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\inf.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\inf.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\lnk.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\lnk.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\msc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\msc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\reg.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\reg.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\scr.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8\scr.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\bat.reg
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\bat.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\cmd.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\cmd.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\com.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\com.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\dir.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\dir.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\drive.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\drive.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\exe.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\exe.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\folder.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\folder.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\inf.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\inf.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\lnk.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\lnk.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\msc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\msc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\reg.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\reg.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\scr.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista\scr.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\bat.reg
[08/17/2014 09:22:14] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\bat.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\cmd.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\cmd.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\com.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\com.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\dir.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\dir.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\drive.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\drive.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\exe.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\exe.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\folder.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\folder.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\inf.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\inf.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\lnk.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\lnk.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\msc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\msc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\reg.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\reg.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\scr.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp\scr.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair bat Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair bat Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair cmd Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair cmd Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair com Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair com Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Directory Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Directory Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Drive Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Drive Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair exe Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair exe Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair File Associations.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair File Associations.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Folder Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Folder Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair inf Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair inf Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair lnk _Shortcuts_ Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair lnk _Shortcuts_ Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair msc Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair msc Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair reg Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair reg Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair scr Association.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair scr Association.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\fix_insufficient_resources.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\fix_insufficient_resources.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Winsock _ DNS Cache.txt
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Winsock _ DNS Cache.txt
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\iphlpsvc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\iphlpsvc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\sharedaccess.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\sharedaccess.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\spooler.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\spooler.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\iphlpsvc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\iphlpsvc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\sharedaccess.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\sharedaccess.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\spooler.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\spooler.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\iphlpsvc.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\iphlpsvc.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\sharedaccess.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\sharedaccess.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\spooler.reg
[08/17/2014 09:22:14] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\spooler.reg
[08/17/2014 09:22:14] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\sharedaccess.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\sharedaccess.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\spooler.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\spooler.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Print Spooler.txt
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Print Spooler.txt
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Restore Important Windows Services.txt
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Restore Important Windows Services.txt
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\svchost_gpsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\svchost_gpsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\windefend.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\windefend.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\windefend.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\windefend.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\svchost_gpsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\svchost_gpsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\windefend.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\windefend.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\swprv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\swprv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\vds.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\vds.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\vss.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\vss.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\wbengine.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\wbengine.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\swprv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\swprv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\vds.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\vds.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\vss.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\vss.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\wbengine.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\wbengine.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\swprv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\swprv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\vds.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\vds.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\vss.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\vss.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\wbengine.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\wbengine.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\swprv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\swprv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\vss.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\vss.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\ie.txt
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\ie.txt
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\mdac.txt
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\mdac.txt
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\msiserver.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\msiserver.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\sppsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\sppsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\msiserver.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\msiserver.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\sppsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\sppsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\msiserver.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\msiserver.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\MSIServer.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\MSIServer.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\tweaking_tabs.ocx
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\tweaking_tabs.ocx
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\remove_symbolic_links_from_windows_defender_folder.bat
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\remove_symbolic_links_from_windows_defender_folder.bat
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\pcwintech_tasksch.dll
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\pcwintech_tasksch.dll
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\SSubTmr6.dll
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\SSubTmr6.dll
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\tweaking_com_treeview.ocx
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\tweaking_com_treeview.ocx
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\tweaking_tabs.ocx
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\tweaking_tabs.ocx
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\cryptsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\cryptsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\cryptsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\cryptsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\bfe.reg
[08/17/2014 09:22:15] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\8.1\
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\bfe.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\bits.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\bits.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\cryptsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\cryptsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\iphlpsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\iphlpsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\mpssvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\mpssvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\msiserver.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\msiserver.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\safeboot.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\safeboot.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\sharedaccess.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\sharedaccess.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\spooler.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\spooler.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\sppsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\sppsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\swprv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\swprv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\vds.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\vds.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\vss.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\vss.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\wbengine.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\wbengine.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\windefend.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\windefend.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\wscsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\wscsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\wuauserv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\wuauserv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\bat.reg
[08/17/2014 09:22:15] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\bat.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\cmd.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\cmd.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\com.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\com.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\dir.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\dir.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\drive.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\drive.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\exe.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\exe.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\folder.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\folder.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\inf.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\inf.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\lnk.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\lnk.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\msc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\msc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\reg.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\reg.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\scr.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1\scr.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\cryptsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\cryptsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\bits.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\bits.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\cryptsvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\cryptsvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_7_8_2008_2012_32.exe
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_7_8_2008_2012_32.exe
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_7_8_2008_2012_64.exe
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\vss_7_8_2008_2012_64.exe
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows 8 App Store.txt
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows 8 App Store.txt
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows 8 Component Store.txt
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows 8 Component Store.txt
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\Tweaking_CleanMem.exe
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\Tweaking_CleanMem.exe
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\Tweaking_CleanMem.exe.manifest
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\Tweaking_CleanMem.exe.manifest
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\Tweaking_CleanMem.ini
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\Tweaking_CleanMem.ini
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\AFD.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\AFD.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\AudioEndpointBuilder.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\AudioEndpointBuilder.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\Audiosrv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\Audiosrv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\Browser.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\Browser.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\DcomLaunch.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\DcomLaunch.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\Dhcp.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\Dhcp.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\Dnscache.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\Dnscache.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\EventSystem.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\EventSystem.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\hidserv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\hidserv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\lmhosts.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\lmhosts.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\NetBT.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\NetBT.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\nsi.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\nsi.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\PlugPlay.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\PlugPlay.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\PolicyAgent.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\PolicyAgent.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\RpcSs.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\RpcSs.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\Schedule.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\Schedule.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\ShellHWDetection.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\ShellHWDetection.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\tdx.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\tdx.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\WinHttpAutoProxySvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\WinHttpAutoProxySvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\winmgmt.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\winmgmt.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\afd.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\afd.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\audioendpointbuilder.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\audioendpointbuilder.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\audiosrv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\audiosrv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\browser.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\browser.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\dcomlaunch.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\dcomlaunch.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\dhcp.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\dhcp.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\dnscache.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\dnscache.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\eventsystem.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\eventsystem.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\hidserv.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\hidserv.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\lmhosts.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\lmhosts.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\netbt.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\netbt.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\nsi.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\nsi.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\plugplay.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\plugplay.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\policyagent.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\policyagent.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\rpcss.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\rpcss.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\schedule.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\schedule.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\shellhwdetection.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\shellhwdetection.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\tdx.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\tdx.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\winhttpautoproxysvc.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\winhttpautoproxysvc.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\winmgmt.reg
[08/17/2014 09:22:15] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\winmgmt.reg
[08/17/2014 09:22:15] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\afd.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\afd.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\audioendpointbuilder.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\audioendpointbuilder.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\audiosrv.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\audiosrv.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\browser.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\browser.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\dcomlaunch.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\dcomlaunch.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\dhcp.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\dhcp.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\dnscache.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\dnscache.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\eventsystem.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\eventsystem.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\hidserv.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\hidserv.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\lmhosts.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\lmhosts.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\netbt.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\netbt.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\nsi.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\nsi.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\plugplay.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\plugplay.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\policyagent.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\policyagent.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\rpcss.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\rpcss.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\schedule.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\schedule.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\shellhwdetection.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\shellhwdetection.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\tdx.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\tdx.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\winhttpautoproxysvc.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\winhttpautoproxysvc.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\winmgmt.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\winmgmt.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\AFD.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\AFD.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\AudioEndpointBuilder.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\AudioEndpointBuilder.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\AudioSrv.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\AudioSrv.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\bowser.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\bowser.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\DcomLaunch.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\DcomLaunch.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\Dhcp.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\Dhcp.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\Dnscache.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\Dnscache.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\EventSystem.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\EventSystem.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\hidserv.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\hidserv.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\lmhosts.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\lmhosts.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\netbt.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\netbt.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\nsi.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\nsi.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\PlugPlay.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\PlugPlay.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\PolicyAgent.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\PolicyAgent.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\RpcSs.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\RpcSs.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\Schedule.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\Schedule.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\ShellHWDetection.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\ShellHWDetection.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\tdx.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\tdx.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\WinHttpAutoProxySvc.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\WinHttpAutoProxySvc.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\winmgmt.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\winmgmt.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\AFD.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\AFD.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\AudioSrv.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\AudioSrv.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\Browser.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\Browser.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\DcomLaunch.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\DcomLaunch.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\Dhcp.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\Dhcp.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\Dnscache.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\Dnscache.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\EventSystem.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\EventSystem.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\HidServ.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\HidServ.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\LmHosts.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\LmHosts.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\NetBT.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\NetBT.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\PlugPlay.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\PlugPlay.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\PolicyAgent.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\PolicyAgent.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\RpcSs.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\RpcSs.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\Schedule.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\Schedule.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\ShellHWDetection.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\ShellHWDetection.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\xp\winmgmt.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp\winmgmt.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\file_permissions_excludes.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\file_permissions_excludes.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\file_permissions_profiles_excludes.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\file_permissions_profiles_excludes.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\services_startup_7.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\services_startup_7.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\services_startup_8.1.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\services_startup_8.1.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\services_startup_8.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\services_startup_8.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\services_startup_vista.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\services_startup_vista.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\services_startup_xp.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\services_startup_xp.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\color_presets\Default.ini
[08/17/2014 09:22:16] Success Create folder: C:\Users\Owner\Desktop\color_presets\
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\color_presets\Default.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\color_presets\Grey & Black.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\color_presets\Grey & Black.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\color_presets\Light.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\color_presets\Light.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\color_presets\Olive Green.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\color_presets\Olive Green.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\color_presets\Silver.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\color_presets\Silver.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\color_presets\Windows Classic.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\color_presets\Windows Classic.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\color_presets\_ReadMe.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\color_presets\_ReadMe.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\dps.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\dps.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\dps.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\dps.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\dps.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\dps.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\dps.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\dps.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Start Menu Icons Removed By Infections.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Start Menu Icons Removed By Infections.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\Unmarshalers.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\Unmarshalers.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\Unmarshalers.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\Unmarshalers.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\keywords.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\keywords.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Default.ini
[08/17/2014 09:22:16] Success Create folder: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Default.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Grey & Black.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Grey & Black.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Light.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Light.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Olive Green.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Olive Green.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Silver.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Silver.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Windows Classic.ini
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\Windows Classic.ini
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\_ReadMe.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets\_ReadMe.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\registry_backup_tool\files\Backup_Failed_Message.exe
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files\Backup_Failed_Message.exe
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Restore Windows 8 COM_ Unmarshalers.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Restore Windows 8 COM_ Unmarshalers.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\file_list.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\file_list.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\SetACL_32.exe
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\SetACL_32.exe
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\SetACL_64.exe
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\SetACL_64.exe
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\StringCacheSettings.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\StringCacheSettings.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\StringCacheSettings.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\StringCacheSettings.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\StringCacheSettings.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\StringCacheSettings.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\StringCacheSettings.reg
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\StringCacheSettings.reg
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Reset Service Permissions.txt
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Reset Service Permissions.txt
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\tweaking_ras.exe
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\tweaking_ras.exe
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\tweaking_ras.exe.manifest
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\files\tweaking_ras.exe.manifest
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\7za.dll
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\7za.dll
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\VszLib.dll
[08/17/2014 09:22:16] Success File added to uninstall list: C:\Users\Owner\Desktop\VszLib.dll
[08/17/2014 09:22:16] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\default.7z
[08/17/2014 09:22:16] Success Create folder: C:\Users\Owner\Desktop\files\permissions\
[08/17/2014 09:22:16] Success Create folder: C:\Users\Owner\Desktop\files\permissions\8\
[08/17/2014 09:22:17] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\default.7z
[08/17/2014 09:22:17] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\hkcr.7z
[08/17/2014 09:22:17] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\hkcr.7z
[08/17/2014 09:22:17] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\hkcu.7z
[08/17/2014 09:22:17] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\hkcu.7z
[08/17/2014 09:22:17] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\hklm.7z
[08/17/2014 09:22:17] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\hklm.7z
[08/17/2014 09:22:17] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\profile.7z
[08/17/2014 09:22:17] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\profile.7z
[08/17/2014 09:22:17] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\programdata.7z
[08/17/2014 09:22:17] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\programdata.7z
[08/17/2014 09:22:17] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\windows.7z
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\windows.7z
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\hkud.7z
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\hkud.7z
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\program_files.7z
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\program_files.7z
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\permissions\8\program_files_x86.7z
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8\program_files_x86.7z
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\tweaking_rati.exe
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\tweaking_rati.exe
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\tweaking_rati.exe.manifest
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\tweaking_rati.exe.manifest
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\vista-7-8\32bit.reg
[08/17/2014 09:22:18] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\
[08/17/2014 09:22:18] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\vista-7-8\
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\vista-7-8\32bit.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\vista-7-8\64bit.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\vista-7-8\64bit.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\xp\32bit.reg
[08/17/2014 09:22:18] Success Create folder: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\xp\
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\xp\32bit.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\repairs_info\Repair Windows New Submenu.txt
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\repairs_info\Repair Windows New Submenu.txt
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\oleaut32.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\oleaut32.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\7\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\oleaut32.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\oleaut32.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\oleaut32.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\oleaut32.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\8.1\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\oleaut32.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\oleaut32.reg
[08/17/2014 09:22:18] Success Install archive file: C:\Users\Owner\Desktop\files\regfiles\vista\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success File added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista\oleaut32_wow64.reg
[08/17/2014 09:22:18] Success Create folder: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\
[08/17/2014 09:22:18] Success Create folder: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)\
[08/17/2014 09:22:18] Success Create shortcut: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)\Tweaking.com - Windows Repair (All in One).lnk
[08/17/2014 09:22:18] Success Shortcut added to uninstall list: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)\Tweaking.com - Windows Repair (All in One).lnk
[08/17/2014 09:22:18] Success Create shortcut: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)\Tweaking.com - Registry Backup.lnk
[08/17/2014 09:22:18] Success Shortcut added to uninstall list: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)\Tweaking.com - Registry Backup.lnk
[08/17/2014 09:22:18] Success Copy uninstall image file: C:\Users\Owner\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG->C:\Users\Owner\Desktop\Uninstall\IRIMG1.JPG
[08/17/2014 09:22:18] Success Support file added to uninstall list: C:\Users\Owner\Desktop\Uninstall\IRIMG1.JPG
[08/17/2014 09:22:18] Success Copy uninstall image file: C:\Users\Owner\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG->C:\Users\Owner\Desktop\Uninstall\IRIMG2.JPG
[08/17/2014 09:22:18] Success Support file added to uninstall list: C:\Users\Owner\Desktop\Uninstall\IRIMG2.JPG
[08/17/2014 09:22:18] Success Registry key added to uninstall list: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tweaking.com - Windows Repair (All in One)
[08/17/2014 09:22:18] Success Uninstall CP entry: DisplayName = Tweaking.com - Windows Repair (All in One)
[08/17/2014 09:22:18] Success Uninstall CP entry: UninstallString = "C:\Users\Owner\Desktop\uninstall.exe" "/U:C:\Users\Owner\Desktop\Uninstall\uninstall.xml"
[08/17/2014 09:22:18] Success Uninstall CP entry: Publisher = Tweaking.com
[08/17/2014 09:22:18] Success Uninstall CP entry: URLInfoAbout = http://www.tweaking.com
[08/17/2014 09:22:18] Success Uninstall CP entry: HelpLink = http://www.tweaking.com
[08/17/2014 09:22:18] Success Uninstall CP entry: Contact = Tweaking.com Support Department
[08/17/2014 09:22:18] Success Uninstall CP entry: DisplayVersion = 2.8.6
[08/17/2014 09:22:18] Success Uninstall CP entry: InstallLocation = C:\Users\Owner\Desktop
[08/17/2014 09:22:18] Success Uninstall CP entry: DisplayIcon = "C:\Users\Owner\Desktop\uninstall.exe"
[08/17/2014 09:22:18] Success Create uninstall shortcut: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)\Uninstall Tweaking.com - Windows Repair (All in One).lnk
[08/17/2014 09:22:18] Success Shortcut added to uninstall list: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)\Uninstall Tweaking.com - Windows Repair (All in One).lnk
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\Uninstall
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\7
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\vista
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\xp
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\files
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\repairs_info
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\7
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\vista
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\xp
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\8.1
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\file_associations\8.1
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\color_presets
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\registry_backup_tool\color_presets
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\permissions
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\permissions\8
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\vista-7-8
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\Desktop\files\regfiles\windows_new_submenu\xp
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com
[08/17/2014 09:22:18] Success Folder added to uninstall list: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com\Windows Repair (All in One)
[08/17/2014 09:22:18] Notice Start project event: On Post Install
[08/17/2014 09:22:18] Success Run project event: On Post Install
[08/17/2014 09:22:18] Success Display screen: Check Boxes
[08/17/2014 09:22:30] Success Display screen: Finished Install
[08/17/2014 09:22:32] Notice Start project event: On Shutdown
[08/17/2014 09:22:32] Success Run project event: On Shutdown
[08/17/2014 09:22:32] Success Delete image file: C:\Users\Owner\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
[08/17/2014 09:22:32] Success Delete image file: C:\Users\Owner\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG
[08/17/2014 09:22:32] Notice Exit setup process (Return code: 0)
 

  • 0

#20
Biscuithd
Posted 18 August 2014 - 06:37 AM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts

We can cleanup the Desktop, that's not an issue.

 

Actually all of the Windows Repair went fine.

 

I don't see anything from the Driver Update which is my greatest concern. How did that go?


  • 0

#21
OGdexter
Posted 18 August 2014 - 06:43 PM

OGdexter

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 106 posts

Driver update is still on the desktop, (as is all the clutter) I noticed it in the Task Scheduler Library, changed it's permissions down a peg from "highest level" on my own, just looking at it's properties and habits made me uneasy. Also changed it's trigger to weekly, not every time someone logs on.

 

Edit.

just looked there again it's back to "run at log on"


Edited by OGdexter, 18 August 2014 - 06:46 PM.

  • 0

#22
Biscuithd
Posted 18 August 2014 - 07:33 PM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts
I'm not sure what your telling me? What does does the "clutter" have to do with updating drivers?

We're you able to update your drivers and has that corrected the crashing? Also, certainly this is your computer, but if you are adjusting the task scheduler and permissions, etc. you may be creating some of your own issues. Typically home users do not require these kinds of inter sessions and often one adjustment forces other changes In a never ending cycle.
  • 0

#23
OGdexter
Posted 19 August 2014 - 06:50 PM

OGdexter

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 106 posts

I ttempted to change it but i guess those settings may be default or were reset to what I first observed by the Windows Repair All process.

 

So the upshot is my changes didn't take anyway.

 

So far so good, notciced some minor changes so far like when I hit delete on items in my Inbox, I get a dialog box asking if I'm sure ( a little irritating, of course I'm sure, that's why I hit the Delete button, I still ************************************get a dialog box there as always.

 

And I'm still getting unexpected shutdowns, like when I was writing this, auto saved content before the asterisks.

 

(edit) and I'm getting a dialog box saying  (when I open windows livemail) "Initialization of RSS feed support failed, RSS feeds could not be updated"

 

whatever that means


Edited by OGdexter, 19 August 2014 - 06:54 PM.

  • 0

#24
Biscuithd
Posted 20 August 2014 - 07:00 AM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts

I'm thinking that your issues at hardware related and not malware. There is one thing we can try. If this doesn't work, then I suggest that you open a topic in the Hardware Section.

 

I want you to do a Startup Repair...three times in a row, regardless of what the report tells you! 

 

Once you've done the repair three times, then boot normally and tell me how the machine is working.


  • 0

#25
Biscuithd
Posted 24 August 2014 - 07:50 AM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts

Did the Startup Repair help?


  • 0

Advertisements

#26
OGdexter
Posted 24 August 2014 - 08:08 AM

OGdexter

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 106 posts

How do I do that? I searched for it but not feeling very trusting about sources outside of this place for procedures that can possibly make my problems worse


  • 0

#27
Biscuithd
Posted 24 August 2014 - 11:24 AM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts

Run Windows 7 SRD:

Boot from the Windows 7 SRD disc.
 

  • If not sure how to, a very good tutorial can be read here.
  • You will have to answer a few basic questions then select the option Repair your computer
  • At the the System Recovery Options screen click Windows 7 to highlight then Next>
  • Now click on/select Startup Repair
  • If prompted to use System Restore, select Cancel.
  • The same if prompted to Send information about this problem (recommended), select Don't send.
  • Click Finish when Startup Repair has completed. Repeat this three times!

  • 0

#28
OGdexter
Posted 24 August 2014 - 08:53 PM

OGdexter

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 106 posts

Ran it three times, read the notes, nine tests none show problems. I DO notice that when in Backup and Restore, "Windows cannot find the disc or network location where (my) backups are being saved" I click on "Options" and select "Try to run backup again" , I get the dialog box asking me if I want to allow (Microsoft Windows Backup ) to make changes to this computer. When I click "yes" ............nothing

 

I have a 500 Gig hard disc installed in my tower (Coolermaster) (replaced by my current 1TB hard drive) supposedly tasked by my "trusted installer" for backup.................apparently NOT hooked up? or Windows can't find it? ...or what?


  • 0

#29
Biscuithd
Posted 25 August 2014 - 06:44 AM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts

Backup and Restore and can't find a disk are more Hardware/Software issues. Might I recommend posting here. I try to stick to Malware.

 

Anything else I can help you with in the Malware area? :)


  • 0

#30
Biscuithd
Posted 29 August 2014 - 07:24 AM

Biscuithd

    Trusted Helper

  • Malware Removal
  • 2,573 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP