ZZ / 7 lat, 6 miesięcy temu | Download | Plaintext | Odpowiedz |

   1
   2
   3
   4
   5
   6
   7
   8
   9
  10
  11
  12
  13
  14
  15
  16
  17
  18
  19
  20
  21
  22
  23
  24
  25
  26
  27
  28
  29
  30
  31
  32
  33
  34
  35
  36
  37
  38
  39
  40
  41
  42
  43
  44
  45
  46
  47
  48
  49
  50
  51
  52
  53
  54
  55
  56
  57
  58
  59
  60
  61
  62
  63
  64
  65
  66
  67
  68
  69
  70
  71
  72
  73
  74
  75
  76
  77
  78
  79
  80
  81
  82
  83
  84
  85
  86
  87
  88
  89
  90
  91
  92
  93
  94
  95
  96
  97
  98
  99
 100
 101
 102
 103
 104
 105
 106
 107
 108
 109
 110
 111
 112
 113
 114
 115
 116
 117
 118
 119
 120
 121
 122
 123
 124
 125
 126
 127
 128
 129
 130
 131
 132
 133
 134
 135
 136
 137
 138
 139
 140
 141
 142
 143
 144
 145
 146
 147
 148
 149
 150
 151
 152
 153
 154
 155
 156
 157
 158
 159
 160
 161
 162
 163
 164
 165
 166
 167
 168
 169
 170
 171
 172
 173
 174
 175
 176
 177
 178
 179
 180
 181
 182
 183
 184
 185
 186
 187
 188
 189
 190
 191
 192
 193
 194
 195
 196
 197
 198
 199
 200
 201
 202
 203
 204
 205
 206
 207
 208
 209
 210
 211
 212
 213
 214
 215
 216
 217
 218
 219
 220
 221
 222
 223
 224
 225
 226
 227
 228
 229
 230
 231
 232
 233
 234
 235
 236
 237
 238
 239
 240
 241
 242
 243
 244
 245
 246
 247
 248
 249
 250
 251
 252
 253
 254
 255
 256
 257
 258
 259
 260
 261
 262
 263
 264
 265
 266
 267
 268
 269
 270
 271
 272
 273
 274
 275
 276
 277
 278
 279
 280
 281
 282
 283
 284
 285
 286
 287
 288
 289
 290
 291
 292
 293
 294
 295
 296
 297
 298
 299
 300
 301
 302
 303
 304
 305
 306
 307
 308
 309
 310
 311
 312
 313
 314
 315
 316
 317
 318
 319
 320
 321
 322
 323
 324
 325
 326
 327
 328
 329
 330
 331
 332
 333
 334
 335
 336
 337
 338
 339
 340
 341
 342
 343
 344
 345
 346
 347
 348
 349
 350
 351
 352
 353
 354
 355
 356
 357
 358
 359
 360
 361
 362
 363
 364
 365
 366
 367
 368
 369
 370
 371
 372
 373
 374
 375
 376
 377
 378
 379
 380
 381
 382
 383
 384
 385
 386
 387
 388
 389
 390
 391
 392
 393
 394
 395
 396
 397
 398
 399
 400
 401
 402
 403
 404
 405
 406
 407
 408
 409
 410
 411
 412
 413
 414
 415
 416
 417
 418
 419
 420
 421
 422
 423
 424
 425
 426
 427
 428
 429
 430
 431
 432
 433
 434
 435
 436
 437
 438
 439
 440
 441
 442
 443
 444
 445
 446
 447
 448
 449
 450
 451
 452
 453
 454
 455
 456
 457
 458
 459
 460
 461
 462
 463
 464
 465
 466
 467
 468
 469
 470
 471
 472
 473
 474
 475
 476
 477
 478
 479
 480
 481
 482
 483
 484
 485
 486
 487
 488
 489
 490
 491
 492
 493
 494
 495
 496
 497
 498
 499
 500
 501
 502
 503
 504
 505
 506
 507
 508
 509
 510
 511
 512
 513
 514
 515
 516
 517
 518
 519
 520
 521
 522
 523
 524
 525
 526
 527
 528
 529
 530
 531
 532
 533
 534
 535
 536
 537
 538
 539
 540
 541
 542
 543
 544
 545
 546
 547
 548
 549
 550
 551
 552
 553
 554
 555
 556
 557
 558
 559
 560
 561
 562
 563
 564
 565
 566
 567
 568
 569
 570
 571
 572
 573
 574
 575
 576
 577
 578
 579
 580
 581
 582
 583
 584
 585
 586
 587
 588
 589
 590
 591
 592
 593
 594
 595
 596
 597
 598
 599
 600
 601
 602
 603
 604
 605
 606
 607
 608
 609
 610
 611
 612
 613
 614
 615
 616
 617
 618
 619
 620
 621
 622
 623
 624
 625
 626
 627
 628
 629
 630
 631
 632
 633
 634
 635
 636
 637
 638
 639
 640
 641
 642
 643
 644
 645
 646
 647
 648
 649
 650
 651
 652
 653
 654
 655
 656
 657
 658
 659
 660
 661
 662
 663
 664
 665
 666
 667
 668
 669
 670
 671
 672
 673
 674
 675
 676
 677
 678
 679
 680
 681
 682
 683
 684
 685
 686
 687
 688
 689
 690
 691
 692
 693
 694
 695
 696
 697
 698
 699
 700
 701
 702
 703
 704
 705
 706
 707
 708
 709
 710
 711
 712
 713
 714
 715
 716
 717
 718
 719
 720
 721
 722
 723
 724
 725
 726
 727
 728
 729
 730
 731
 732
 733
 734
 735
 736
 737
 738
 739
 740
 741
 742
 743
 744
 745
 746
 747
 748
 749
 750
 751
 752
 753
 754
 755
 756
 757
 758
 759
 760
 761
 762
 763
 764
 765
 766
 767
 768
 769
 770
 771
 772
 773
 774
 775
 776
 777
 778
 779
 780
 781
 782
 783
 784
 785
 786
 787
 788
 789
 790
 791
 792
 793
 794
 795
 796
 797
 798
 799
 800
 801
 802
 803
 804
 805
 806
 807
 808
 809
 810
 811
 812
 813
 814
 815
 816
 817
 818
 819
 820
 821
 822
 823
 824
 825
 826
 827
 828
 829
 830
 831
 832
 833
 834
 835
 836
 837
 838
 839
 840
 841
 842
 843
 844
 845
 846
 847
 848
 849
 850
 851
 852
 853
 854
 855
 856
 857
 858
 859
 860
 861
 862
 863
 864
 865
 866
 867
 868
 869
 870
 871
 872
 873
 874
 875
 876
 877
 878
 879
 880
 881
 882
 883
 884
 885
 886
 887
 888
 889
 890
 891
 892
 893
 894
 895
 896
 897
 898
 899
 900
 901
 902
 903
 904
 905
 906
 907
 908
 909
 910
 911
 912
 913
 914
 915
 916
 917
 918
 919
 920
 921
 922
 923
 924
 925
 926
 927
 928
 929
 930
 931
 932
 933
 934
 935
 936
 937
 938
 939
 940
 941
 942
 943
 944
 945
 946
 947
 948
 949
 950
 951
 952
 953
 954
 955
 956
 957
 958
 959
 960
 961
 962
 963
 964
 965
 966
 967
 968
 969
 970
 971
 972
 973
 974
 975
 976
 977
 978
 979
 980
 981
 982
 983
 984
 985
 986
 987
 988
 989
 990
 991
 992
 993
 994
 995
 996
 997
 998
 999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
GMER 1.0.15.15125 - http://www.gmer.net
Rootkit scan 2010-10-07 21:16:40
Windows 5.1.2600 Dodatek Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\PRZERE~1\USTAWI~1\Temp\kwlciaod.sys


---- System - GMER 1.0.15 ----

SSDT            \??\C:\WINDOWS\system32\DRIVERS\PavProc.sys (Panda Protection driver/Panda Security, S.L.)                                                                                            ZwTerminateProcess [0xB64E44E8]
SSDT            \??\C:\WINDOWS\system32\PavSRK.sys                                                                                                                                                    ZwWriteVirtualMemory [0xB63AFC30]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2FE8                                                                                                                                                  80504884 4 Bytes  CALL FD0696CD 
?               C:\WINDOWS\system32\PavTPK.sys                                                                                                                                                        Nie można odnaleźć określonego pliku. !
?               C:\WINDOWS\system32\PavSRK.sys                                                                                                                                                        Nie można odnaleźć określonego pliku. !
?               system32\drivers\av5flt.sys                                                                                                                                                           System nie może odnaleźć określonej ścieżki. !

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtClose                                                                                      7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtClose + 4                                                                                  7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtCreateFile                                                                                 7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtCreateFile                                                                                 7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtCreateFile + 4                                                                             7C90D0B2 2 Bytes  [65, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtCreateKey                                                                                  7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtCreateKey + 4                                                                              7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDeleteFile                                                                                 7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDeleteFile + 4                                                                             7C90D242 2 Bytes  [68, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDeleteKey                                                                                  7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDeleteKey + 4                                                                              7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDeleteValueKey                                                                             7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDeleteValueKey + 4                                                                         7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDuplicateObject                                                                            7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtDuplicateObject + 4                                                                        7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtEnumerateKey                                                                               7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtEnumerateKey + 4                                                                           7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtEnumerateValueKey                                                                          7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtEnumerateValueKey + 4                                                                      7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtLoadDriver                                                                                 7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtLoadDriver + 4                                                                             7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtOpenFile                                                                                   7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtOpenFile + 4                                                                               7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtQueryMultipleValueKey                                                                      7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtQueryMultipleValueKey + 4                                                                  7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtQueryValueKey                                                                              7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtQueryValueKey + 4                                                                          7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtReadFile                                                                                   7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtReadFile + 4                                                                               7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtSetContextThread                                                                           7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtSetContextThread + 4                                                                       7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtSetInformationFile                                                                         7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtSetInformationFile + 4                                                                     7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtSetValueKey                                                                                7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtSetValueKey + 4                                                                            7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtUnloadKey                                                                                  7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtUnloadKey + 4                                                                              7C90DED2 2 Bytes  [62, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtWriteFile                                                                                  7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtWriteFile + 4                                                                              7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtWriteVirtualMemory                                                                         7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ntdll.dll!NtWriteVirtualMemory + 4                                                                     7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!TerminateProcess                                                                          7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!CreateFileMappingW                                                                        7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!MapViewOfFileEx                                                                           7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!CreateRemoteThread                                                                        7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!CreateRemoteThread + 4                                                                    7C8104D0 2 Bytes  [3E, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!MoveFileWithProgressW                                                                     7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!MoveFileWithProgressW + 4                                                                 7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] kernel32.dll!CopyFileExW                                                                               7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!DispatchMessageW                                                                            7E368A01 6 Bytes  JMP 5FAF0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!TranslateMessage                                                                            7E368BF6 6 Bytes  JMP 5F8E0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!PostMessageW                                                                                7E368CCB 6 Bytes  JMP 5FA00F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!DispatchMessageA                                                                            7E3696B8 6 Bytes  JMP 5F8B0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!CreateAcceleratorTableW                                                                     7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!CreateAcceleratorTableW + 4                                                                 7E36D9BF 2 Bytes  [AA, 5F] {STOSB ; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!SetWindowsHookExW                                                                           7E37820F 6 Bytes  JMP 5FAC0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!GetKeyState                                                                                 7E379ED9 6 Bytes  JMP 5F9A0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!GetAsyncKeyState                                                                            7E37A78F 6 Bytes  JMP 5F910F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!PostMessageA                                                                                7E37AAFD 6 Bytes  JMP 5FA30F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!BeginDeferWindowPos                                                                         7E37AFB9 6 Bytes  JMP 5F880F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!GetKeyboardState                                                                            7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!GetKeyboardState + 4                                                                        7E37D22A 2 Bytes  [98, 5F] {CWDE ; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!SetClipboardData                                                                            7E380F9E 6 Bytes  JMP 5FB20F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!SetWindowsHookExA                                                                           7E381211 6 Bytes  JMP 5F850F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!SetWinEventHook                                                                             7E3817F7 6 Bytes  JMP 5FA60F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!AttachThreadInput                                                                           7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!AttachThreadInput + 4                                                                       7E381E56 2 Bytes  [95, 5F] {XCHG EBP, EAX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] USER32.dll!DdeConnect                                                                                  7E3A81C3 6 Bytes  JMP 5F9D0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!CloseServiceHandle                                                                        77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!OpenServiceW                                                                              77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!StartServiceA                                                                             77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!StartServiceW                                                                             77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!ControlService                                                                            77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!OpenServiceA                                                                              77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!LsaAddAccountRights                                                                       77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!LsaRemoveAccountRights                                                                    77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!ChangeServiceConfigA                                                                      77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!ChangeServiceConfigW                                                                      77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!ChangeServiceConfig2A                                                                     77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!ChangeServiceConfig2W                                                                     77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                 77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!CreateServiceA                                                                            77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!CreateServiceW                                                                            77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ADVAPI32.dll!DeleteService                                                                             77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ole32.dll!CLSIDFromProgID                                                                              775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe[428] ole32.dll!CLSIDFromProgIDEx                                                                            7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!sendto                                                                                                                          71A52F51 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!recvfrom                                                                                                                        71A52FF7 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!closesocket                                                                                                                     71A53E2B 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!connect                                                                                                                         71A54A07 6 Bytes  JMP 5F040F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!send                                                                                                                            71A54C27 6 Bytes  JMP 5F0D0F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!WSARecv                                                                                                                         71A54CB5 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!recv                                                                                                                            71A5676F 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!WSASend                                                                                                                         71A568FA 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!WSARecvFrom                                                                                                                     71A5F66A 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!WSASendTo                                                                                                                       71A60AAD 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\wbem\wmiapsrv.exe[464] WS2_32.dll!WSAConnect                                                                                                                      71A60C81 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtClose                                                                                                                 7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtClose + 4                                                                                                             7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtCreateFile                                                                                                            7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtCreateFile                                                                                                            7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtCreateFile + 4                                                                                                        7C90D0B2 2 Bytes  [65, 5F]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtCreateKey                                                                                                             7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtCreateKey + 4                                                                                                         7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDeleteFile                                                                                                            7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDeleteFile + 4                                                                                                        7C90D242 2 Bytes  [68, 5F]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDeleteKey                                                                                                             7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDeleteKey + 4                                                                                                         7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDeleteValueKey                                                                                                        7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDeleteValueKey + 4                                                                                                    7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDuplicateObject                                                                                                       7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtDuplicateObject + 4                                                                                                   7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtEnumerateKey                                                                                                          7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtEnumerateKey + 4                                                                                                      7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtEnumerateValueKey                                                                                                     7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtEnumerateValueKey + 4                                                                                                 7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtLoadDriver                                                                                                            7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtLoadDriver + 4                                                                                                        7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtOpenFile                                                                                                              7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtOpenFile + 4                                                                                                          7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtQueryMultipleValueKey                                                                                                 7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtQueryMultipleValueKey + 4                                                                                             7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtQueryValueKey                                                                                                         7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtQueryValueKey + 4                                                                                                     7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtReadFile                                                                                                              7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtReadFile + 4                                                                                                          7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtSetContextThread                                                                                                      7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtSetContextThread + 4                                                                                                  7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtSetInformationFile                                                                                                    7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtSetInformationFile + 4                                                                                                7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtSetValueKey                                                                                                           7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtSetValueKey + 4                                                                                                       7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtUnloadKey                                                                                                             7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtUnloadKey + 4                                                                                                         7C90DED2 2 Bytes  [62, 5F]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtWriteFile                                                                                                             7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtWriteFile + 4                                                                                                         7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtWriteVirtualMemory                                                                                                    7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ntdll.dll!NtWriteVirtualMemory + 4                                                                                                7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!TerminateProcess                                                                                                     7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!CreateFileMappingW                                                                                                   7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!MapViewOfFileEx                                                                                                      7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!CreateRemoteThread                                                                                                   7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!CreateRemoteThread + 4                                                                                               7C8104D0 2 Bytes  [3E, 5F]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!MoveFileWithProgressW                                                                                                7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!MoveFileWithProgressW + 4                                                                                            7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] kernel32.dll!CopyFileExW                                                                                                          7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!CloseServiceHandle                                                                                                   77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!OpenServiceW                                                                                                         77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!StartServiceA                                                                                                        77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!StartServiceW                                                                                                        77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!ControlService                                                                                                       77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!OpenServiceA                                                                                                         77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!LsaAddAccountRights                                                                                                  77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!LsaRemoveAccountRights                                                                                               77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!ChangeServiceConfigA                                                                                                 77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!ChangeServiceConfigW                                                                                                 77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!ChangeServiceConfig2A                                                                                                77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!ChangeServiceConfig2W                                                                                                77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                                            77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!CreateServiceA                                                                                                       77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!CreateServiceW                                                                                                       77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ADVAPI32.dll!DeleteService                                                                                                        77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!DispatchMessageW                                                                                                       7E368A01 6 Bytes  JMP 5FB50F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!TranslateMessage                                                                                                       7E368BF6 6 Bytes  JMP 5F940F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!PostMessageW                                                                                                           7E368CCB 6 Bytes  JMP 5FA60F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!DispatchMessageA                                                                                                       7E3696B8 6 Bytes  JMP 5F910F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!CreateAcceleratorTableW                                                                                                7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!CreateAcceleratorTableW + 4                                                                                            7E36D9BF 2 Bytes  [B0, 5F] {MOV AL, 0x5f}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!SetWindowsHookExW                                                                                                      7E37820F 6 Bytes  JMP 5FB20F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!GetKeyState                                                                                                            7E379ED9 6 Bytes  JMP 5FA00F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!GetAsyncKeyState                                                                                                       7E37A78F 6 Bytes  JMP 5F970F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!PostMessageA                                                                                                           7E37AAFD 6 Bytes  JMP 5FA90F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!BeginDeferWindowPos                                                                                                    7E37AFB9 6 Bytes  JMP 5F8E0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!GetKeyboardState                                                                                                       7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!GetKeyboardState + 4                                                                                                   7E37D22A 2 Bytes  [9E, 5F] {SAHF ; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!SetClipboardData                                                                                                       7E380F9E 6 Bytes  JMP 5FB80F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!SetWindowsHookExA                                                                                                      7E381211 6 Bytes  JMP 5F8B0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!SetWinEventHook                                                                                                        7E3817F7 6 Bytes  JMP 5FAC0F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!AttachThreadInput                                                                                                      7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!AttachThreadInput + 4                                                                                                  7E381E56 2 Bytes  [9B, 5F] {WAIT ; POP EDI}
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] USER32.dll!DdeConnect                                                                                                             7E3A81C3 6 Bytes  JMP 5FA30F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ole32.dll!CoCreateInstanceEx                                                                                                      774F0526 6 Bytes  JMP 5F880F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ole32.dll!CoGetClassObject                                                                                                        775056C5 6 Bytes  JMP 5F850F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ole32.dll!CLSIDFromProgID                                                                                                         775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe[892] ole32.dll!CLSIDFromProgIDEx                                                                                                       7754620D 6 Bytes  JMP 5F7F0F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!sendto                                                                                                              71A52F51 6 Bytes  JMP 5F100F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!recvfrom                                                                                                            71A52FF7 6 Bytes  JMP 5F0A0F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!closesocket                                                                                                         71A53E2B 6 Bytes  JMP 5F220F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!connect                                                                                                             71A54A07 6 Bytes  JMP 5F040F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!send                                                                                                                71A54C27 6 Bytes  JMP 5F0D0F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!WSARecv                                                                                                             71A54CB5 6 Bytes  JMP 5F160F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!recv                                                                                                                71A5676F 6 Bytes  JMP 5F070F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!WSASend                                                                                                             71A568FA 6 Bytes  JMP 5F1C0F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!WSARecvFrom                                                                                                         71A5F66A 6 Bytes  JMP 5F190F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!WSASendTo                                                                                                           71A60AAD 6 Bytes  JMP 5F1F0F5A 
.text           D:\Program Files\Aplikacje\Inne\Java\bin\jqs.exe[1720] WS2_32.dll!WSAConnect                                                                                                          71A60C81 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtClose                                                                                                                                       7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtClose + 4                                                                                                                                   7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtCreateFile                                                                                                                                  7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtCreateFile                                                                                                                                  7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtCreateFile + 4                                                                                                                              7C90D0B2 2 Bytes  [65, 5F]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtCreateKey                                                                                                                                   7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtCreateKey + 4                                                                                                                               7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDeleteFile                                                                                                                                  7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDeleteFile + 4                                                                                                                              7C90D242 2 Bytes  [68, 5F]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDeleteKey                                                                                                                                   7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDeleteKey + 4                                                                                                                               7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDeleteValueKey                                                                                                                              7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDeleteValueKey + 4                                                                                                                          7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDuplicateObject                                                                                                                             7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtDuplicateObject + 4                                                                                                                         7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtEnumerateKey                                                                                                                                7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtEnumerateKey + 4                                                                                                                            7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtEnumerateValueKey                                                                                                                           7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtEnumerateValueKey + 4                                                                                                                       7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtLoadDriver                                                                                                                                  7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtLoadDriver + 4                                                                                                                              7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtOpenFile                                                                                                                                    7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtOpenFile + 4                                                                                                                                7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtQueryMultipleValueKey                                                                                                                       7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtQueryMultipleValueKey + 4                                                                                                                   7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtQueryValueKey                                                                                                                               7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtQueryValueKey + 4                                                                                                                           7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtReadFile                                                                                                                                    7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtReadFile + 4                                                                                                                                7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtSetContextThread                                                                                                                            7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtSetContextThread + 4                                                                                                                        7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtSetInformationFile                                                                                                                          7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtSetInformationFile + 4                                                                                                                      7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtSetValueKey                                                                                                                                 7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtSetValueKey + 4                                                                                                                             7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtUnloadKey                                                                                                                                   7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtUnloadKey + 4                                                                                                                               7C90DED2 2 Bytes  [62, 5F]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtWriteFile                                                                                                                                   7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtWriteFile + 4                                                                                                                               7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtWriteVirtualMemory                                                                                                                          7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ntdll.dll!NtWriteVirtualMemory + 4                                                                                                                      7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!TerminateProcess                                                                                                                           7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!CreateFileMappingW                                                                                                                         7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!MapViewOfFileEx                                                                                                                            7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!CreateRemoteThread                                                                                                                         7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!CreateRemoteThread + 4                                                                                                                     7C8104D0 2 Bytes  [3E, 5F]
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!MoveFileWithProgressW                                                                                                                      7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!MoveFileWithProgressW + 4                                                                                                                  7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] kernel32.dll!CopyFileExW                                                                                                                                7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!CloseServiceHandle                                                                                                                         77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!OpenServiceW                                                                                                                               77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!StartServiceA                                                                                                                              77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!StartServiceW                                                                                                                              77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!ControlService                                                                                                                             77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!OpenServiceA                                                                                                                               77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!LsaAddAccountRights                                                                                                                        77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!LsaRemoveAccountRights                                                                                                                     77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!ChangeServiceConfigA                                                                                                                       77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!ChangeServiceConfigW                                                                                                                       77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!ChangeServiceConfig2A                                                                                                                      77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!ChangeServiceConfig2W                                                                                                                      77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                                                                  77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!CreateServiceA                                                                                                                             77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!CreateServiceW                                                                                                                             77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\explorer.exe[1924] ADVAPI32.dll!DeleteService                                                                                                                              77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!DispatchMessageW                                                                                                                             7E368A01 6 Bytes  JMP 5FAF0F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!TranslateMessage                                                                                                                             7E368BF6 6 Bytes  JMP 5F8E0F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!PostMessageW                                                                                                                                 7E368CCB 6 Bytes  JMP 5FA00F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!DispatchMessageA                                                                                                                             7E3696B8 6 Bytes  JMP 5F8B0F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!CreateAcceleratorTableW                                                                                                                      7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!CreateAcceleratorTableW + 4                                                                                                                  7E36D9BF 2 Bytes  [AA, 5F] {STOSB ; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!SetWindowsHookExW                                                                                                                            7E37820F 6 Bytes  JMP 5FAC0F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!GetKeyState                                                                                                                                  7E379ED9 6 Bytes  JMP 5F9A0F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!GetAsyncKeyState                                                                                                                             7E37A78F 6 Bytes  JMP 5F910F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!PostMessageA                                                                                                                                 7E37AAFD 6 Bytes  JMP 5FA30F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!BeginDeferWindowPos                                                                                                                          7E37AFB9 6 Bytes  JMP 5F880F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!GetKeyboardState                                                                                                                             7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!GetKeyboardState + 4                                                                                                                         7E37D22A 2 Bytes  [98, 5F] {CWDE ; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!SetClipboardData                                                                                                                             7E380F9E 6 Bytes  JMP 5FB20F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!SetWindowsHookExA                                                                                                                            7E381211 6 Bytes  JMP 5F850F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!SetWinEventHook                                                                                                                              7E3817F7 6 Bytes  JMP 5FA60F5A 
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!AttachThreadInput                                                                                                                            7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!AttachThreadInput + 4                                                                                                                        7E381E56 2 Bytes  [95, 5F] {XCHG EBP, EAX; POP EDI}
.text           C:\WINDOWS\explorer.exe[1924] USER32.dll!DdeConnect                                                                                                                                   7E3A81C3 6 Bytes  JMP 5F9D0F5A 
.text           C:\WINDOWS\explorer.exe[1924] ole32.dll!CLSIDFromProgID                                                                                                                               775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\WINDOWS\explorer.exe[1924] ole32.dll!CLSIDFromProgIDEx                                                                                                                             7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!sendto                                                                                                                                       71A52F51 6 Bytes  JMP 5FC10F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!recvfrom                                                                                                                                     71A52FF7 6 Bytes  JMP 5FBB0F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!closesocket                                                                                                                                  71A53E2B 6 Bytes  JMP 5FD30F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!connect                                                                                                                                      71A54A07 6 Bytes  JMP 5FB50F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!send                                                                                                                                         71A54C27 6 Bytes  JMP 5FBE0F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!WSARecv                                                                                                                                      71A54CB5 6 Bytes  JMP 5FC70F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!recv                                                                                                                                         71A5676F 6 Bytes  JMP 5FB80F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!WSASend                                                                                                                                      71A568FA 6 Bytes  JMP 5FCD0F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!WSARecvFrom                                                                                                                                  71A5F66A 6 Bytes  JMP 5FCA0F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!WSASendTo                                                                                                                                    71A60AAD 6 Bytes  JMP 5FD00F5A 
.text           C:\WINDOWS\explorer.exe[1924] WS2_32.dll!WSAConnect                                                                                                                                   71A60C81 6 Bytes  JMP 5FC40F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtLoadDriver                                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtLoadDriver + 4                                                                                     7C90D472 2 Bytes  [9E, 5F] {SAHF ; POP EDI}
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtSetContextThread                                                                                   7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtSetContextThread + 4                                                                               7C90DBB2 2 Bytes  [9B, 5F] {WAIT ; POP EDI}
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtSetInformationFile                                                                                 7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtSetInformationFile + 4                                                                             7C90DC62 2 Bytes  [92, 5F] {XCHG EDX, EAX; POP EDI}
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtWriteFile                                                                                          7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtWriteFile + 4                                                                                      7C90DF82 2 Bytes  [95, 5F] {XCHG EBP, EAX; POP EDI}
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtWriteVirtualMemory                                                                                 7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ntdll.dll!NtWriteVirtualMemory + 4                                                                             7C90DFB2 2 Bytes  [98, 5F] {CWDE ; POP EDI}
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!DispatchMessageW                                                                                    7E368A01 6 Bytes  JMP 5FD00F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!TranslateMessage                                                                                    7E368BF6 6 Bytes  JMP 5FAF0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!PostMessageW                                                                                        7E368CCB 6 Bytes  JMP 5FC10F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!DispatchMessageA                                                                                    7E3696B8 6 Bytes  JMP 5FAC0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!CreateAcceleratorTableW                                                                             7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!CreateAcceleratorTableW + 4                                                                         7E36D9BF 2 Bytes  [CB, 5F] {RETF ; POP EDI}
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!SetWindowsHookExW                                                                                   7E37820F 6 Bytes  JMP 5FCD0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!GetKeyState                                                                                         7E379ED9 6 Bytes  JMP 5FBB0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!GetAsyncKeyState                                                                                    7E37A78F 6 Bytes  JMP 5FB20F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!PostMessageA                                                                                        7E37AAFD 6 Bytes  JMP 5FC40F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!BeginDeferWindowPos                                                                                 7E37AFB9 6 Bytes  JMP 5FA90F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!GetKeyboardState                                                                                    7E37D226 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!GetKeyboardState + 4                                                                                7E37D22A 2 Bytes  [B9, 5F]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!SetClipboardData                                                                                    7E380F9E 6 Bytes  JMP 5FD30F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!SetWindowsHookExA                                                                                   7E381211 6 Bytes  JMP 5FA60F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!SetWinEventHook                                                                                     7E3817F7 6 Bytes  JMP 5FC70F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!AttachThreadInput                                                                                   7E381E52 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!AttachThreadInput + 4                                                                               7E381E56 2 Bytes  [B6, 5F] {MOV DH, 0x5f}
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] USER32.dll!DdeConnect                                                                                          7E3A81C3 6 Bytes  JMP 5FBE0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ole32.dll!CLSIDFromProgID                                                                                      775087F2 6 Bytes  JMP 5FA30F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] ole32.dll!CLSIDFromProgIDEx                                                                                    7754620D 6 Bytes  JMP 5FA00F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!sendto                                                                                              71A52F51 6 Bytes  JMP 5F100F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!recvfrom                                                                                            71A52FF7 6 Bytes  JMP 5F0A0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!closesocket                                                                                         71A53E2B 6 Bytes  JMP 5F220F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!connect                                                                                             71A54A07 6 Bytes  JMP 5F040F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!send                                                                                                71A54C27 6 Bytes  JMP 5F0D0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!WSARecv                                                                                             71A54CB5 6 Bytes  JMP 5F160F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!recv                                                                                                71A5676F 6 Bytes  JMP 5F070F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!WSASend                                                                                             71A568FA 6 Bytes  JMP 5F1C0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!WSARecvFrom                                                                                         71A5F66A 6 Bytes  JMP 5F190F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!WSASendTo                                                                                           71A60AAD 6 Bytes  JMP 5F1F0F5A 
.text           D:\Program Files\Aplikacje\Aplikacje Internetowe\Opera\opera.exe[2332] WS2_32.dll!WSAConnect                                                                                          71A60C81 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtClose                                                                                                                                7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtClose + 4                                                                                                                            7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtCreateFile                                                                                                                           7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtCreateFile                                                                                                                           7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtCreateFile + 4                                                                                                                       7C90D0B2 2 Bytes  [65, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtCreateKey                                                                                                                            7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtCreateKey + 4                                                                                                                        7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDeleteFile                                                                                                                           7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDeleteFile + 4                                                                                                                       7C90D242 2 Bytes  [68, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDeleteKey                                                                                                                            7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDeleteKey + 4                                                                                                                        7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDeleteValueKey                                                                                                                       7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDeleteValueKey + 4                                                                                                                   7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDuplicateObject                                                                                                                      7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtDuplicateObject + 4                                                                                                                  7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtEnumerateKey                                                                                                                         7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtEnumerateKey + 4                                                                                                                     7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtEnumerateValueKey                                                                                                                    7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtEnumerateValueKey + 4                                                                                                                7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtLoadDriver                                                                                                                           7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtLoadDriver + 4                                                                                                                       7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtOpenFile                                                                                                                             7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtOpenFile + 4                                                                                                                         7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtQueryMultipleValueKey                                                                                                                7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtQueryMultipleValueKey + 4                                                                                                            7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtQueryValueKey                                                                                                                        7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtQueryValueKey + 4                                                                                                                    7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtReadFile                                                                                                                             7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtReadFile + 4                                                                                                                         7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtSetContextThread                                                                                                                     7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtSetContextThread + 4                                                                                                                 7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtSetInformationFile                                                                                                                   7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtSetInformationFile + 4                                                                                                               7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtSetValueKey                                                                                                                          7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtSetValueKey + 4                                                                                                                      7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtUnloadKey                                                                                                                            7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtUnloadKey + 4                                                                                                                        7C90DED2 2 Bytes  [62, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtWriteFile                                                                                                                            7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtWriteFile + 4                                                                                                                        7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtWriteVirtualMemory                                                                                                                   7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ntdll.dll!NtWriteVirtualMemory + 4                                                                                                               7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!TerminateProcess                                                                                                                    7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!CreateFileMappingW                                                                                                                  7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!MapViewOfFileEx                                                                                                                     7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!CreateRemoteThread                                                                                                                  7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!CreateRemoteThread + 4                                                                                                              7C8104D0 2 Bytes  [3E, 5F]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!MoveFileWithProgressW                                                                                                               7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!MoveFileWithProgressW + 4                                                                                                           7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] kernel32.dll!CopyFileExW                                                                                                                         7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!CloseServiceHandle                                                                                                                  77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!OpenServiceW                                                                                                                        77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!StartServiceA                                                                                                                       77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!StartServiceW                                                                                                                       77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!ControlService                                                                                                                      77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!OpenServiceA                                                                                                                        77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!LsaAddAccountRights                                                                                                                 77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!LsaRemoveAccountRights                                                                                                              77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!ChangeServiceConfigA                                                                                                                77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!ChangeServiceConfigW                                                                                                                77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!ChangeServiceConfig2A                                                                                                               77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!ChangeServiceConfig2W                                                                                                               77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                                                           77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!CreateServiceA                                                                                                                      77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!CreateServiceW                                                                                                                      77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ADVAPI32.dll!DeleteService                                                                                                                       77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!DispatchMessageW                                                                                                                      7E368A01 6 Bytes  JMP 5FAF0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!TranslateMessage                                                                                                                      7E368BF6 6 Bytes  JMP 5F8E0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!PostMessageW                                                                                                                          7E368CCB 6 Bytes  JMP 5FA00F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!DispatchMessageA                                                                                                                      7E3696B8 6 Bytes  JMP 5F8B0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!CreateAcceleratorTableW                                                                                                               7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!CreateAcceleratorTableW + 4                                                                                                           7E36D9BF 2 Bytes  [AA, 5F] {STOSB ; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!SetWindowsHookExW                                                                                                                     7E37820F 6 Bytes  JMP 5FAC0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!GetKeyState                                                                                                                           7E379ED9 6 Bytes  JMP 5F9A0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!GetAsyncKeyState                                                                                                                      7E37A78F 6 Bytes  JMP 5F910F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!PostMessageA                                                                                                                          7E37AAFD 6 Bytes  JMP 5FA30F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!BeginDeferWindowPos                                                                                                                   7E37AFB9 6 Bytes  JMP 5F880F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!GetKeyboardState                                                                                                                      7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!GetKeyboardState + 4                                                                                                                  7E37D22A 2 Bytes  [98, 5F] {CWDE ; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!SetClipboardData                                                                                                                      7E380F9E 6 Bytes  JMP 5FB20F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!SetWindowsHookExA                                                                                                                     7E381211 6 Bytes  JMP 5F850F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!SetWinEventHook                                                                                                                       7E3817F7 6 Bytes  JMP 5FA60F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!AttachThreadInput                                                                                                                     7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!AttachThreadInput + 4                                                                                                                 7E381E56 2 Bytes  [95, 5F] {XCHG EBP, EAX; POP EDI}
.text           C:\WINDOWS\system32\ctfmon.exe[2380] USER32.dll!DdeConnect                                                                                                                            7E3A81C3 6 Bytes  JMP 5F9D0F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ole32.dll!CLSIDFromProgID                                                                                                                        775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\WINDOWS\system32\ctfmon.exe[2380] ole32.dll!CLSIDFromProgIDEx                                                                                                                      7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtClose                                                                                                                                        7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtClose + 4                                                                                                                                    7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtCreateFile                                                                                                                                   7C90D0AE 1 Byte  [FF]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtCreateFile                                                                                                                                   7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtCreateFile + 4                                                                                                                               7C90D0B2 2 Bytes  [65, 5F]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtCreateKey                                                                                                                                    7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtCreateKey + 4                                                                                                                                7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDeleteFile                                                                                                                                   7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDeleteFile + 4                                                                                                                               7C90D242 2 Bytes  [68, 5F]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDeleteKey                                                                                                                                    7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDeleteKey + 4                                                                                                                                7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDeleteValueKey                                                                                                                               7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDeleteValueKey + 4                                                                                                                           7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDuplicateObject                                                                                                                              7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtDuplicateObject + 4                                                                                                                          7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtEnumerateKey                                                                                                                                 7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtEnumerateKey + 4                                                                                                                             7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtEnumerateValueKey                                                                                                                            7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtEnumerateValueKey + 4                                                                                                                        7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtLoadDriver                                                                                                                                   7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtLoadDriver + 4                                                                                                                               7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtOpenFile                                                                                                                                     7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtOpenFile + 4                                                                                                                                 7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtQueryMultipleValueKey                                                                                                                        7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtQueryMultipleValueKey + 4                                                                                                                    7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtQueryValueKey                                                                                                                                7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtQueryValueKey + 4                                                                                                                            7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtReadFile                                                                                                                                     7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtReadFile + 4                                                                                                                                 7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtSetContextThread                                                                                                                             7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtSetContextThread + 4                                                                                                                         7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtSetInformationFile                                                                                                                           7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtSetInformationFile + 4                                                                                                                       7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtSetValueKey                                                                                                                                  7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtSetValueKey + 4                                                                                                                              7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtUnloadKey                                                                                                                                    7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtUnloadKey + 4                                                                                                                                7C90DED2 2 Bytes  [62, 5F]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtWriteFile                                                                                                                                    7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtWriteFile + 4                                                                                                                                7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtWriteVirtualMemory                                                                                                                           7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ntdll.dll!NtWriteVirtualMemory + 4                                                                                                                       7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!TerminateProcess                                                                                                                            7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!CreateFileMappingW                                                                                                                          7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!MapViewOfFileEx                                                                                                                             7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!CreateRemoteThread                                                                                                                          7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!CreateRemoteThread + 4                                                                                                                      7C8104D0 2 Bytes  [3E, 5F]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!MoveFileWithProgressW                                                                                                                       7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!MoveFileWithProgressW + 4                                                                                                                   7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] kernel32.dll!CopyFileExW                                                                                                                                 7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!CloseServiceHandle                                                                                                                          77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!OpenServiceW                                                                                                                                77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!StartServiceA                                                                                                                               77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!StartServiceW                                                                                                                               77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!ControlService                                                                                                                              77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!OpenServiceA                                                                                                                                77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!LsaAddAccountRights                                                                                                                         77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!LsaRemoveAccountRights                                                                                                                      77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!ChangeServiceConfigA                                                                                                                        77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!ChangeServiceConfigW                                                                                                                        77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!ChangeServiceConfig2A                                                                                                                       77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!ChangeServiceConfig2W                                                                                                                       77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                                                                   77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!CreateServiceA                                                                                                                              77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!CreateServiceW                                                                                                                              77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ADVAPI32.dll!DeleteService                                                                                                                               77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ole32.dll!CoCreateInstanceEx                                                                                                                             774F0526 6 Bytes  JMP 5F880F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ole32.dll!CoGetClassObject                                                                                                                               775056C5 6 Bytes  JMP 5F850F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ole32.dll!CLSIDFromProgID                                                                                                                                775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] ole32.dll!CLSIDFromProgIDEx                                                                                                                              7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!DispatchMessageW                                                                                                                              7E368A01 6 Bytes  JMP 5FB50F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!TranslateMessage                                                                                                                              7E368BF6 6 Bytes  JMP 5F940F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!PostMessageW                                                                                                                                  7E368CCB 6 Bytes  JMP 5FA60F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!DispatchMessageA                                                                                                                              7E3696B8 6 Bytes  JMP 5F910F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!CreateAcceleratorTableW                                                                                                                       7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!CreateAcceleratorTableW + 4                                                                                                                   7E36D9BF 2 Bytes  [B0, 5F] {MOV AL, 0x5f}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!SetWindowsHookExW                                                                                                                             7E37820F 6 Bytes  JMP 5FB20F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!GetKeyState                                                                                                                                   7E379ED9 6 Bytes  JMP 5FA00F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!GetAsyncKeyState                                                                                                                              7E37A78F 6 Bytes  JMP 5F970F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!PostMessageA                                                                                                                                  7E37AAFD 6 Bytes  JMP 5FA90F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!BeginDeferWindowPos                                                                                                                           7E37AFB9 6 Bytes  JMP 5F8E0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!GetKeyboardState                                                                                                                              7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!GetKeyboardState + 4                                                                                                                          7E37D22A 2 Bytes  [9E, 5F] {SAHF ; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!SetClipboardData                                                                                                                              7E380F9E 6 Bytes  JMP 5FB80F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!SetWindowsHookExA                                                                                                                             7E381211 6 Bytes  JMP 5F8B0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!SetWinEventHook                                                                                                                               7E3817F7 6 Bytes  JMP 5FAC0F5A 
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!AttachThreadInput                                                                                                                             7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!AttachThreadInput + 4                                                                                                                         7E381E56 2 Bytes  [9B, 5F] {WAIT ; POP EDI}
.text           C:\WINDOWS\RTHDCPL.EXE[2544] USER32.dll!DdeConnect                                                                                                                                    7E3A81C3 6 Bytes  JMP 5FA30F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtClose                                                                                                                   7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtClose + 4                                                                                                               7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtCreateFile                                                                                                              7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtCreateFile                                                                                                              7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtCreateFile + 4                                                                                                          7C90D0B2 2 Bytes  [65, 5F]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtCreateKey                                                                                                               7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtCreateKey + 4                                                                                                           7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDeleteFile                                                                                                              7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDeleteFile + 4                                                                                                          7C90D242 2 Bytes  [68, 5F]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDeleteKey                                                                                                               7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDeleteKey + 4                                                                                                           7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDeleteValueKey                                                                                                          7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDeleteValueKey + 4                                                                                                      7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDuplicateObject                                                                                                         7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtDuplicateObject + 4                                                                                                     7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtEnumerateKey                                                                                                            7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtEnumerateKey + 4                                                                                                        7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtEnumerateValueKey                                                                                                       7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtEnumerateValueKey + 4                                                                                                   7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtLoadDriver                                                                                                              7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtLoadDriver + 4                                                                                                          7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtOpenFile                                                                                                                7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtOpenFile + 4                                                                                                            7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtQueryMultipleValueKey                                                                                                   7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtQueryMultipleValueKey + 4                                                                                               7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtQueryValueKey                                                                                                           7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtQueryValueKey + 4                                                                                                       7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtReadFile                                                                                                                7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtReadFile + 4                                                                                                            7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtSetContextThread                                                                                                        7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtSetContextThread + 4                                                                                                    7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtSetInformationFile                                                                                                      7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtSetInformationFile + 4                                                                                                  7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtSetValueKey                                                                                                             7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtSetValueKey + 4                                                                                                         7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtUnloadKey                                                                                                               7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtUnloadKey + 4                                                                                                           7C90DED2 2 Bytes  [62, 5F]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtWriteFile                                                                                                               7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtWriteFile + 4                                                                                                           7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtWriteVirtualMemory                                                                                                      7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ntdll.dll!NtWriteVirtualMemory + 4                                                                                                  7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!TerminateProcess                                                                                                       7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!CreateFileMappingW                                                                                                     7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!MapViewOfFileEx                                                                                                        7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!CreateRemoteThread                                                                                                     7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!CreateRemoteThread + 4                                                                                                 7C8104D0 2 Bytes  [3E, 5F]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!MoveFileWithProgressW                                                                                                  7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!MoveFileWithProgressW + 4                                                                                              7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] kernel32.dll!CopyFileExW                                                                                                            7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!DispatchMessageW                                                                                                         7E368A01 6 Bytes  JMP 5FB50F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!TranslateMessage                                                                                                         7E368BF6 6 Bytes  JMP 5F940F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!PostMessageW                                                                                                             7E368CCB 6 Bytes  JMP 5FA60F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!DispatchMessageA                                                                                                         7E3696B8 6 Bytes  JMP 5F910F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!CreateAcceleratorTableW                                                                                                  7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!CreateAcceleratorTableW + 4                                                                                              7E36D9BF 2 Bytes  [B0, 5F] {MOV AL, 0x5f}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!SetWindowsHookExW                                                                                                        7E37820F 6 Bytes  JMP 5FB20F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!GetKeyState                                                                                                              7E379ED9 6 Bytes  JMP 5FA00F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!GetAsyncKeyState                                                                                                         7E37A78F 6 Bytes  JMP 5F970F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!PostMessageA                                                                                                             7E37AAFD 6 Bytes  JMP 5FA90F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!BeginDeferWindowPos                                                                                                      7E37AFB9 6 Bytes  JMP 5F8E0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!GetKeyboardState                                                                                                         7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!GetKeyboardState + 4                                                                                                     7E37D22A 2 Bytes  [9E, 5F] {SAHF ; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!SetClipboardData                                                                                                         7E380F9E 6 Bytes  JMP 5FB80F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!SetWindowsHookExA                                                                                                        7E381211 6 Bytes  JMP 5F8B0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!SetWinEventHook                                                                                                          7E3817F7 6 Bytes  JMP 5FAC0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!AttachThreadInput                                                                                                        7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!AttachThreadInput + 4                                                                                                    7E381E56 2 Bytes  [9B, 5F] {WAIT ; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] USER32.dll!DdeConnect                                                                                                               7E3A81C3 6 Bytes  JMP 5FA30F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!CloseServiceHandle                                                                                                     77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!OpenServiceW                                                                                                           77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!StartServiceA                                                                                                          77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!StartServiceW                                                                                                          77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!ControlService                                                                                                         77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!OpenServiceA                                                                                                           77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!LsaAddAccountRights                                                                                                    77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!LsaRemoveAccountRights                                                                                                 77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!ChangeServiceConfigA                                                                                                   77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!ChangeServiceConfigW                                                                                                   77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!ChangeServiceConfig2A                                                                                                  77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!ChangeServiceConfig2W                                                                                                  77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                                              77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!CreateServiceA                                                                                                         77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!CreateServiceW                                                                                                         77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ADVAPI32.dll!DeleteService                                                                                                          77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ole32.dll!CoCreateInstanceEx                                                                                                        774F0526 6 Bytes  JMP 5F880F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ole32.dll!CoGetClassObject                                                                                                          775056C5 6 Bytes  JMP 5F850F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ole32.dll!CLSIDFromProgID                                                                                                           775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] ole32.dll!CLSIDFromProgIDEx                                                                                                         7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!sendto                                                                                                                   71A52F51 6 Bytes  JMP 5FC70F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!recvfrom                                                                                                                 71A52FF7 6 Bytes  JMP 5FC10F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!closesocket                                                                                                              71A53E2B 6 Bytes  JMP 5FD90F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!connect                                                                                                                  71A54A07 6 Bytes  JMP 5FBB0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!send                                                                                                                     71A54C27 6 Bytes  JMP 5FC40F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!WSARecv                                                                                                                  71A54CB5 6 Bytes  JMP 5FCD0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!recv                                                                                                                     71A5676F 6 Bytes  JMP 5FBE0F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!WSASend                                                                                                                  71A568FA 6 Bytes  JMP 5FD30F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!WSARecvFrom                                                                                                              71A5F66A 6 Bytes  JMP 5FD00F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!WSASendTo                                                                                                                71A60AAD 6 Bytes  JMP 5FD60F5A 
.text           C:\Program Files\GIGABYTE\GBTUpd\RunUpd.exe[2616] WS2_32.dll!WSAConnect                                                                                                               71A60C81 6 Bytes  JMP 5FCA0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtClose                                                                                           7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtClose + 4                                                                                       7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtCreateFile                                                                                      7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtCreateFile                                                                                      7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtCreateFile + 4                                                                                  7C90D0B2 2 Bytes  [65, 5F]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtCreateKey                                                                                       7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtCreateKey + 4                                                                                   7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDeleteFile                                                                                      7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDeleteFile + 4                                                                                  7C90D242 2 Bytes  [68, 5F]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDeleteKey                                                                                       7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDeleteKey + 4                                                                                   7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDeleteValueKey                                                                                  7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDeleteValueKey + 4                                                                              7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDuplicateObject                                                                                 7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtDuplicateObject + 4                                                                             7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtEnumerateKey                                                                                    7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtEnumerateKey + 4                                                                                7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtEnumerateValueKey                                                                               7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtEnumerateValueKey + 4                                                                           7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtLoadDriver                                                                                      7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtLoadDriver + 4                                                                                  7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtOpenFile                                                                                        7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtOpenFile + 4                                                                                    7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtQueryMultipleValueKey                                                                           7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtQueryMultipleValueKey + 4                                                                       7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtQueryValueKey                                                                                   7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtQueryValueKey + 4                                                                               7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtReadFile                                                                                        7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtReadFile + 4                                                                                    7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtSetContextThread                                                                                7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtSetContextThread + 4                                                                            7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtSetInformationFile                                                                              7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtSetInformationFile + 4                                                                          7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtSetValueKey                                                                                     7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtSetValueKey + 4                                                                                 7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtUnloadKey                                                                                       7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtUnloadKey + 4                                                                                   7C90DED2 2 Bytes  [62, 5F]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtWriteFile                                                                                       7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtWriteFile + 4                                                                                   7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtWriteVirtualMemory                                                                              7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ntdll.dll!NtWriteVirtualMemory + 4                                                                          7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!TerminateProcess                                                                               7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!CreateFileMappingW                                                                             7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!MapViewOfFileEx                                                                                7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!CreateRemoteThread                                                                             7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!CreateRemoteThread + 4                                                                         7C8104D0 2 Bytes  [3E, 5F]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!MoveFileWithProgressW                                                                          7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!MoveFileWithProgressW + 4                                                                      7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] kernel32.dll!CopyFileExW                                                                                    7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!DispatchMessageW                                                                                 7E368A01 6 Bytes  JMP 5FB50F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!TranslateMessage                                                                                 7E368BF6 6 Bytes  JMP 5F940F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!PostMessageW                                                                                     7E368CCB 6 Bytes  JMP 5FA60F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!DispatchMessageA                                                                                 7E3696B8 6 Bytes  JMP 5F910F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!CreateAcceleratorTableW                                                                          7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!CreateAcceleratorTableW + 4                                                                      7E36D9BF 2 Bytes  [B0, 5F] {MOV AL, 0x5f}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!SetWindowsHookExW                                                                                7E37820F 6 Bytes  JMP 5FB20F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!GetKeyState                                                                                      7E379ED9 6 Bytes  JMP 5FA00F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!GetAsyncKeyState                                                                                 7E37A78F 6 Bytes  JMP 5F970F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!PostMessageA                                                                                     7E37AAFD 6 Bytes  JMP 5FA90F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!BeginDeferWindowPos                                                                              7E37AFB9 6 Bytes  JMP 5F8E0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!GetKeyboardState                                                                                 7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!GetKeyboardState + 4                                                                             7E37D22A 2 Bytes  [9E, 5F] {SAHF ; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!SetClipboardData                                                                                 7E380F9E 6 Bytes  JMP 5FB80F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!SetWindowsHookExA                                                                                7E381211 6 Bytes  JMP 5F8B0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!SetWinEventHook                                                                                  7E3817F7 6 Bytes  JMP 5FAC0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!AttachThreadInput                                                                                7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!AttachThreadInput + 4                                                                            7E381E56 2 Bytes  [9B, 5F] {WAIT ; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] USER32.dll!DdeConnect                                                                                       7E3A81C3 6 Bytes  JMP 5FA30F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!CloseServiceHandle                                                                             77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!OpenServiceW                                                                                   77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!StartServiceA                                                                                  77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!StartServiceW                                                                                  77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!ControlService                                                                                 77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!OpenServiceA                                                                                   77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!LsaAddAccountRights                                                                            77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!LsaRemoveAccountRights                                                                         77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!ChangeServiceConfigA                                                                           77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!ChangeServiceConfigW                                                                           77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!ChangeServiceConfig2A                                                                          77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!ChangeServiceConfig2W                                                                          77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                      77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!CreateServiceA                                                                                 77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!CreateServiceW                                                                                 77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ADVAPI32.dll!DeleteService                                                                                  77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ole32.dll!CoCreateInstanceEx                                                                                774F0526 6 Bytes  JMP 5F880F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ole32.dll!CoGetClassObject                                                                                  775056C5 6 Bytes  JMP 5F850F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ole32.dll!CLSIDFromProgID                                                                                   775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2984] ole32.dll!CLSIDFromProgIDEx                                                                                 7754620D 6 Bytes  JMP 5F7F0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtClose                                                                                                              7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtClose + 4                                                                                                          7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtCreateFile                                                                                                         7C90D0AE 1 Byte  [FF]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtCreateFile                                                                                                         7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtCreateFile + 4                                                                                                     7C90D0B2 2 Bytes  [65, 5F]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtCreateKey                                                                                                          7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtCreateKey + 4                                                                                                      7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDeleteFile                                                                                                         7C90D23E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDeleteFile + 4                                                                                                     7C90D242 2 Bytes  [68, 5F]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDeleteKey                                                                                                          7C90D24E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDeleteKey + 4                                                                                                      7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDeleteValueKey                                                                                                     7C90D26E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDeleteValueKey + 4                                                                                                 7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDuplicateObject                                                                                                    7C90D29E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtDuplicateObject + 4                                                                                                7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtEnumerateKey                                                                                                       7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtEnumerateKey + 4                                                                                                   7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtEnumerateValueKey                                                                                                  7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtEnumerateValueKey + 4                                                                                              7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtLoadDriver                                                                                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtLoadDriver + 4                                                                                                     7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtOpenFile                                                                                                           7C90D59E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtOpenFile + 4                                                                                                       7C90D5A2 2 Bytes  [6B, 5F]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtQueryMultipleValueKey                                                                                              7C90D86E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtQueryMultipleValueKey + 4                                                                                          7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtQueryValueKey                                                                                                      7C90D96E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtQueryValueKey + 4                                                                                                  7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtReadFile                                                                                                           7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtReadFile + 4                                                                                                       7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtSetContextThread                                                                                                   7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtSetContextThread + 4                                                                                               7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtSetInformationFile                                                                                                 7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtSetInformationFile + 4                                                                                             7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtSetValueKey                                                                                                        7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtSetValueKey + 4                                                                                                    7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtUnloadKey                                                                                                          7C90DECE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtUnloadKey + 4                                                                                                      7C90DED2 2 Bytes  [62, 5F]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtWriteFile                                                                                                          7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtWriteFile + 4                                                                                                      7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtWriteVirtualMemory                                                                                                 7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ntdll.dll!NtWriteVirtualMemory + 4                                                                                             7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!TerminateProcess                                                                                                  7C801E1A 6 Bytes  JMP 5F310F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!CreateFileMappingW                                                                                                7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!MapViewOfFileEx                                                                                                   7C80B936 6 Bytes  JMP 5F340F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!CreateRemoteThread                                                                                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!CreateRemoteThread + 4                                                                                            7C8104D0 2 Bytes  [3E, 5F]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!MoveFileWithProgressW                                                                                             7C81F72E 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!MoveFileWithProgressW + 4                                                                                         7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] kernel32.dll!CopyFileExW                                                                                                       7C827B32 6 Bytes  JMP 5F370F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!CloseServiceHandle                                                                                                77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!OpenServiceW                                                                                                      77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!StartServiceA                                                                                                     77DDFB58 6 Bytes  JMP 5F250F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!StartServiceW                                                                                                     77DE3E94 6 Bytes  JMP 5F280F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!ControlService                                                                                                    77DE4A09 6 Bytes  JMP 5F130F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!OpenServiceA                                                                                                      77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!LsaAddAccountRights                                                                                               77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!LsaRemoveAccountRights                                                                                            77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!ChangeServiceConfigA                                                                                              77E26E69 6 Bytes  JMP 5F040F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!ChangeServiceConfigW                                                                                              77E27001 6 Bytes  JMP 5F070F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!ChangeServiceConfig2A                                                                                             77E27101 6 Bytes  JMP 5F0A0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!ChangeServiceConfig2W                                                                                             77E27189 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                                         77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!CreateServiceA                                                                                                    77E27211 6 Bytes  JMP 5F160F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!CreateServiceW                                                                                                    77E273A9 6 Bytes  JMP 5F190F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ADVAPI32.dll!DeleteService                                                                                                     77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!DispatchMessageW                                                                                                    7E368A01 6 Bytes  JMP 5FB50F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!TranslateMessage                                                                                                    7E368BF6 6 Bytes  JMP 5F940F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!PostMessageW                                                                                                        7E368CCB 6 Bytes  JMP 5FA60F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!DispatchMessageA                                                                                                    7E3696B8 6 Bytes  JMP 5F910F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!CreateAcceleratorTableW                                                                                             7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!CreateAcceleratorTableW + 4                                                                                         7E36D9BF 2 Bytes  [B0, 5F] {MOV AL, 0x5f}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!SetWindowsHookExW                                                                                                   7E37820F 6 Bytes  JMP 5FB20F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!GetKeyState                                                                                                         7E379ED9 6 Bytes  JMP 5FA00F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!GetAsyncKeyState                                                                                                    7E37A78F 6 Bytes  JMP 5F970F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!PostMessageA                                                                                                        7E37AAFD 6 Bytes  JMP 5FA90F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!BeginDeferWindowPos                                                                                                 7E37AFB9 6 Bytes  JMP 5F8E0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!GetKeyboardState                                                                                                    7E37D226 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!GetKeyboardState + 4                                                                                                7E37D22A 2 Bytes  [9E, 5F] {SAHF ; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!SetClipboardData                                                                                                    7E380F9E 6 Bytes  JMP 5FB80F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!SetWindowsHookExA                                                                                                   7E381211 6 Bytes  JMP 5F8B0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!SetWinEventHook                                                                                                     7E3817F7 6 Bytes  JMP 5FAC0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!AttachThreadInput                                                                                                   7E381E52 3 Bytes  [FF, 25, 1E]
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!AttachThreadInput + 4                                                                                               7E381E56 2 Bytes  [9B, 5F] {WAIT ; POP EDI}
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] USER32.dll!DdeConnect                                                                                                          7E3A81C3 6 Bytes  JMP 5FA30F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!sendto                                                                                                              71A52F51 6 Bytes  JMP 5FC70F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!recvfrom                                                                                                            71A52FF7 6 Bytes  JMP 5FC10F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!closesocket                                                                                                         71A53E2B 6 Bytes  JMP 5FD90F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!connect                                                                                                             71A54A07 6 Bytes  JMP 5FBB0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!send                                                                                                                71A54C27 6 Bytes  JMP 5FC40F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!WSARecv                                                                                                             71A54CB5 6 Bytes  JMP 5FCD0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!recv                                                                                                                71A5676F 6 Bytes  JMP 5FBE0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!WSASend                                                                                                             71A568FA 6 Bytes  JMP 5FD30F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!WSARecvFrom                                                                                                         71A5F66A 6 Bytes  JMP 5FD00F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!WSASendTo                                                                                                           71A60AAD 6 Bytes  JMP 5FD60F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] WS2_32.dll!WSAConnect                                                                                                          71A60C81 6 Bytes  JMP 5FCA0F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ole32.dll!CoCreateInstanceEx                                                                                                   774F0526 6 Bytes  JMP 5F880F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ole32.dll!CoGetClassObject                                                                                                     775056C5 6 Bytes  JMP 5F850F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ole32.dll!CLSIDFromProgID                                                                                                      775087F2 6 Bytes  JMP 5F820F5A 
.text           D:\Program Files\Aplikacje\uTorrent\uTorrent.exe[3072] ole32.dll!CLSIDFromProgIDEx                                                                                                    7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtClose                                                                                     7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtClose + 4                                                                                 7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtCreateFile                                                                                7C90D0AE 1 Byte  [FF]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtCreateFile                                                                                7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtCreateFile + 4                                                                            7C90D0B2 2 Bytes  [65, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtCreateKey                                                                                 7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtCreateKey + 4                                                                             7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDeleteFile                                                                                7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDeleteFile + 4                                                                            7C90D242 2 Bytes  [68, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDeleteKey                                                                                 7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDeleteKey + 4                                                                             7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDeleteValueKey                                                                            7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDeleteValueKey + 4                                                                        7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDuplicateObject                                                                           7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtDuplicateObject + 4                                                                       7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtEnumerateKey                                                                              7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtEnumerateKey + 4                                                                          7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtEnumerateValueKey                                                                         7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtEnumerateValueKey + 4                                                                     7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtLoadDriver                                                                                7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtLoadDriver + 4                                                                            7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtOpenFile                                                                                  7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtOpenFile + 4                                                                              7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtQueryMultipleValueKey                                                                     7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtQueryMultipleValueKey + 4                                                                 7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtQueryValueKey                                                                             7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtQueryValueKey + 4                                                                         7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtReadFile                                                                                  7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtReadFile + 4                                                                              7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtSetContextThread                                                                          7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtSetContextThread + 4                                                                      7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtSetInformationFile                                                                        7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtSetInformationFile + 4                                                                    7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtSetValueKey                                                                               7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtSetValueKey + 4                                                                           7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtUnloadKey                                                                                 7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtUnloadKey + 4                                                                             7C90DED2 2 Bytes  [62, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtWriteFile                                                                                 7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtWriteFile + 4                                                                             7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtWriteVirtualMemory                                                                        7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ntdll.dll!NtWriteVirtualMemory + 4                                                                    7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!TerminateProcess                                                                         7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!CreateFileMappingW                                                                       7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!MapViewOfFileEx                                                                          7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!CreateRemoteThread                                                                       7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!CreateRemoteThread + 4                                                                   7C8104D0 2 Bytes  [3E, 5F]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!MoveFileWithProgressW                                                                    7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!MoveFileWithProgressW + 4                                                                7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] kernel32.dll!CopyFileExW                                                                              7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!DispatchMessageW                                                                           7E368A01 6 Bytes  JMP 5FAF0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!TranslateMessage                                                                           7E368BF6 6 Bytes  JMP 5F8E0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!PostMessageW                                                                               7E368CCB 6 Bytes  JMP 5FA00F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!DispatchMessageA                                                                           7E3696B8 6 Bytes  JMP 5F8B0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!CreateAcceleratorTableW                                                                    7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!CreateAcceleratorTableW + 4                                                                7E36D9BF 2 Bytes  [AA, 5F] {STOSB ; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!SetWindowsHookExW                                                                          7E37820F 6 Bytes  JMP 5FAC0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!GetKeyState                                                                                7E379ED9 6 Bytes  JMP 5F9A0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!GetAsyncKeyState                                                                           7E37A78F 6 Bytes  JMP 5F910F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!PostMessageA                                                                               7E37AAFD 6 Bytes  JMP 5FA30F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!BeginDeferWindowPos                                                                        7E37AFB9 6 Bytes  JMP 5F880F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!GetKeyboardState                                                                           7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!GetKeyboardState + 4                                                                       7E37D22A 2 Bytes  [98, 5F] {CWDE ; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!SetClipboardData                                                                           7E380F9E 6 Bytes  JMP 5FB20F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!SetWindowsHookExA                                                                          7E381211 6 Bytes  JMP 5F850F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!SetWinEventHook                                                                            7E3817F7 6 Bytes  JMP 5FA60F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!AttachThreadInput                                                                          7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!AttachThreadInput + 4                                                                      7E381E56 2 Bytes  [95, 5F] {XCHG EBP, EAX; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] USER32.dll!DdeConnect                                                                                 7E3A81C3 6 Bytes  JMP 5F9D0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!CloseServiceHandle                                                                       77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!OpenServiceW                                                                             77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!StartServiceA                                                                            77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!StartServiceW                                                                            77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!ControlService                                                                           77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!OpenServiceA                                                                             77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!LsaAddAccountRights                                                                      77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!LsaRemoveAccountRights                                                                   77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!ChangeServiceConfigA                                                                     77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!ChangeServiceConfigW                                                                     77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!ChangeServiceConfig2A                                                                    77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!ChangeServiceConfig2W                                                                    77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!ChangeServiceConfig2W + 4                                                                77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!CreateServiceA                                                                           77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!CreateServiceW                                                                           77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ADVAPI32.dll!DeleteService                                                                            77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ole32.dll!CLSIDFromProgID                                                                             775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe[3372] ole32.dll!CLSIDFromProgIDEx                                                                           7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtClose                       7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtClose + 4                   7C90CFF2 2 Bytes  [44, 5F] {INC ESP; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtCreateFile                  7C90D0AE 1 Byte  [FF]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtCreateFile                  7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtCreateFile + 4              7C90D0B2 2 Bytes  [65, 5F]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtCreateKey                   7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtCreateKey + 4               7C90D0F2 2 Bytes  [47, 5F] {INC EDI; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDeleteFile                  7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDeleteFile + 4              7C90D242 2 Bytes  [68, 5F]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDeleteKey                   7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDeleteKey + 4               7C90D252 2 Bytes  [4A, 5F] {DEC EDX; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDeleteValueKey              7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDeleteValueKey + 4          7C90D272 2 Bytes  [4D, 5F] {DEC EBP; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDuplicateObject             7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtDuplicateObject + 4         7C90D2A2 2 Bytes  [50, 5F] {PUSH EAX; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtEnumerateKey                7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtEnumerateKey + 4            7C90D2D2 2 Bytes  [53, 5F] {PUSH EBX; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtEnumerateValueKey           7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtEnumerateValueKey + 4       7C90D2F2 2 Bytes  [56, 5F] {PUSH ESI; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtLoadDriver                  7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtLoadDriver + 4              7C90D472 2 Bytes  [7D, 5F] {JGE 0x61}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtOpenFile                    7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtOpenFile + 4                7C90D5A2 2 Bytes  [6B, 5F]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtQueryMultipleValueKey       7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtQueryMultipleValueKey + 4   7C90D872 2 Bytes  [59, 5F] {POP ECX; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtQueryValueKey               7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtQueryValueKey + 4           7C90D972 2 Bytes  [5C, 5F] {POP ESP; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtReadFile                    7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtReadFile + 4                7C90D9D2 2 Bytes  [6E, 5F] {OUTSB ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtSetContextThread            7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtSetContextThread + 4        7C90DBB2 2 Bytes  [7A, 5F] {JP 0x61}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtSetInformationFile          7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtSetInformationFile + 4      7C90DC62 2 Bytes  [71, 5F] {JNO 0x61}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtSetValueKey                 7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtSetValueKey + 4             7C90DDD2 2 Bytes  [5F, 5F] {POP EDI; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtUnloadKey                   7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtUnloadKey + 4               7C90DED2 2 Bytes  [62, 5F]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtWriteFile                   7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtWriteFile + 4               7C90DF82 2 Bytes  [74, 5F] {JZ 0x61}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtWriteVirtualMemory          7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ntdll.dll!NtWriteVirtualMemory + 4      7C90DFB2 2 Bytes  [77, 5F] {JA 0x61}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!TerminateProcess           7C801E1A 6 Bytes  JMP 5F310F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!CreateFileMappingW         7C80943C 6 Bytes  JMP 5F3A0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!MapViewOfFileEx            7C80B936 6 Bytes  JMP 5F340F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!CreateRemoteThread         7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!CreateRemoteThread + 4     7C8104D0 2 Bytes  [3E, 5F]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!MoveFileWithProgressW      7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!MoveFileWithProgressW + 4  7C81F732 2 Bytes  [41, 5F] {INC ECX; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] kernel32.dll!CopyFileExW                7C827B32 6 Bytes  JMP 5F370F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!DispatchMessageW             7E368A01 6 Bytes  JMP 5FB50F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!TranslateMessage             7E368BF6 6 Bytes  JMP 5F940F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!PostMessageW                 7E368CCB 6 Bytes  JMP 5FA60F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!DispatchMessageA             7E3696B8 6 Bytes  JMP 5F910F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!CreateAcceleratorTableW      7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!CreateAcceleratorTableW + 4  7E36D9BF 2 Bytes  [B0, 5F] {MOV AL, 0x5f}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!SetWindowsHookExW            7E37820F 6 Bytes  JMP 5FB20F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!GetKeyState                  7E379ED9 6 Bytes  JMP 5FA00F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!GetAsyncKeyState             7E37A78F 6 Bytes  JMP 5F970F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!PostMessageA                 7E37AAFD 6 Bytes  JMP 5FA90F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!BeginDeferWindowPos          7E37AFB9 6 Bytes  JMP 5F8E0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!GetKeyboardState             7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!GetKeyboardState + 4         7E37D22A 2 Bytes  [9E, 5F] {SAHF ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!SetClipboardData             7E380F9E 6 Bytes  JMP 5FB80F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!SetWindowsHookExA            7E381211 6 Bytes  JMP 5F8B0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!SetWinEventHook              7E3817F7 6 Bytes  JMP 5FAC0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!AttachThreadInput            7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!AttachThreadInput + 4        7E381E56 2 Bytes  [9B, 5F] {WAIT ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] USER32.dll!DdeConnect                   7E3A81C3 6 Bytes  JMP 5FA30F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!CloseServiceHandle         77DD6CE5 6 Bytes  JMP 5F100F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!OpenServiceW               77DD6FFD 6 Bytes  JMP 5F220F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!StartServiceA              77DDFB58 6 Bytes  JMP 5F250F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!StartServiceW              77DE3E94 6 Bytes  JMP 5F280F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!ControlService             77DE4A09 6 Bytes  JMP 5F130F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!OpenServiceA               77DE4C66 6 Bytes  JMP 5F1F0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!LsaAddAccountRights        77E0ABF1 6 Bytes  JMP 5F2B0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!LsaRemoveAccountRights     77E0AC91 6 Bytes  JMP 5F2E0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!ChangeServiceConfigA       77E26E69 6 Bytes  JMP 5F040F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!ChangeServiceConfigW       77E27001 6 Bytes  JMP 5F070F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!ChangeServiceConfig2A      77E27101 6 Bytes  JMP 5F0A0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!ChangeServiceConfig2W      77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!ChangeServiceConfig2W + 4  77E2718D 2 Bytes  [0E, 5F] {PUSH CS; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!CreateServiceA             77E27211 6 Bytes  JMP 5F160F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!CreateServiceW             77E273A9 6 Bytes  JMP 5F190F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ADVAPI32.dll!DeleteService              77E274B1 6 Bytes  JMP 5F1C0F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ole32.dll!CoCreateInstanceEx            774F0526 6 Bytes  JMP 5F880F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ole32.dll!CoGetClassObject              775056C5 6 Bytes  JMP 5F850F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ole32.dll!CLSIDFromProgID               775087F2 6 Bytes  JMP 5F820F5A 
.text           C:\Documents and Settings\Przereklamowany\Moje dokumenty\Wojciech Kus\Wojciech Kus\UWAGA!!! WCHODZISZ NA WŁASNE RYZYKO!!!\gmer\gmer.exe[3512] ole32.dll!CLSIDFromProgIDEx             7754620D 6 Bytes  JMP 5F7F0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtCreateFile + 6                                     7C90D0B4 4 Bytes  [28, 00, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtCreateFile + B                                     7C90D0B9 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtMapViewOfSection + 6                               7C90D524 1 Byte  [28]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtMapViewOfSection + 6                               7C90D524 4 Bytes  [28, 03, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtMapViewOfSection + B                               7C90D529 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenFile + 6                                       7C90D5A4 4 Bytes  [68, 00, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenFile + B                                       7C90D5A9 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenProcess + 6                                    7C90D604 4 Bytes  [A8, 01, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenProcess + B                                    7C90D609 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenProcessToken + 6                               7C90D614 4 Bytes  CALL 7B90EC1A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenProcessToken + B                               7C90D619 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenProcessTokenEx + 6                             7C90D624 4 Bytes  [A8, 02, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenProcessTokenEx + B                             7C90D629 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenThread + 6                                     7C90D664 4 Bytes  [68, 01, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenThread + B                                     7C90D669 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenThreadToken + 6                                7C90D674 4 Bytes  [68, 02, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenThreadToken + B                                7C90D679 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenThreadTokenEx + 6                              7C90D684 4 Bytes  CALL 7B90EC8B 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtOpenThreadTokenEx + B                              7C90D689 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtQueryAttributesFile + 6                            7C90D714 4 Bytes  [A8, 00, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtQueryAttributesFile + B                            7C90D719 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtQueryFullAttributesFile + 6                        7C90D7B4 4 Bytes  CALL 7B90EDB9 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtQueryFullAttributesFile + B                        7C90D7B9 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtSetInformationFile + 6                             7C90DC64 4 Bytes  [28, 01, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtSetInformationFile + B                             7C90DC69 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtSetInformationThread + 6                           7C90DCB4 4 Bytes  [28, 02, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtSetInformationThread + B                           7C90DCB9 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtUnmapViewOfSection + 6                             7C90DF14 1 Byte  [68]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtUnmapViewOfSection + 6                             7C90DF14 4 Bytes  [68, 03, 16, 00]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3800] ntdll.dll!NtUnmapViewOfSection + B                             7C90DF19 1 Byte  [E2]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtClose                                              7C90CFEE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtClose + 4                                          7C90CFF2 2 Bytes  [72, 5F] {JB 0x61}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtCreateFile                                         7C90D0AE 1 Byte  [FF]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtCreateFile                                         7C90D0AE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtCreateFile + 4                                     7C90D0B2 2 Bytes  [93, 5F] {XCHG EBX, EAX; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtCreateKey                                          7C90D0EE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtCreateKey + 4                                      7C90D0F2 2 Bytes  [75, 5F] {JNZ 0x61}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDeleteFile                                         7C90D23E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDeleteFile + 4                                     7C90D242 2 Bytes  [96, 5F] {XCHG ESI, EAX; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDeleteKey                                          7C90D24E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDeleteKey + 4                                      7C90D252 2 Bytes  [78, 5F] {JS 0x61}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDeleteValueKey                                     7C90D26E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDeleteValueKey + 4                                 7C90D272 2 Bytes  [7B, 5F] {JNP 0x61}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDuplicateObject                                    7C90D29E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtDuplicateObject + 4                                7C90D2A2 2 Bytes  [7E, 5F] {JLE 0x61}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtEnumerateKey                                       7C90D2CE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtEnumerateKey + 4                                   7C90D2D2 2 Bytes  [81, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtEnumerateValueKey                                  7C90D2EE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtEnumerateValueKey + 4                              7C90D2F2 2 Bytes  [84, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtLoadDriver                                         7C90D46E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtLoadDriver + 4                                     7C90D472 2 Bytes  [AB, 5F] {STOSD ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenFile                                           7C90D59E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenFile + 4                                       7C90D5A2 2 Bytes  [99, 5F] {CDQ ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtQueryMultipleValueKey                              7C90D86E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtQueryMultipleValueKey + 4                          7C90D872 2 Bytes  [87, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtQueryValueKey                                      7C90D96E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtQueryValueKey + 4                                  7C90D972 2 Bytes  [8A, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtReadFile                                           7C90D9CE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtReadFile + 4                                       7C90D9D2 2 Bytes  [9C, 5F] {PUSHF ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetContextThread                                   7C90DBAE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetContextThread + 4                               7C90DBB2 2 Bytes  [A8, 5F] {TEST AL, 0x5f}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetInformationFile                                 7C90DC5E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetInformationFile + 4                             7C90DC62 2 Bytes  [9F, 5F] {LAHF ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetValueKey                                        7C90DDCE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetValueKey + 4                                    7C90DDD2 2 Bytes  [8D, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtUnloadKey                                          7C90DECE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtUnloadKey + 4                                      7C90DED2 2 Bytes  [90, 5F] {NOP ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtWriteFile                                          7C90DF7E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtWriteFile + 4                                      7C90DF82 2 Bytes  [A2, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtWriteVirtualMemory                                 7C90DFAE 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtWriteVirtualMemory + 4                             7C90DFB2 2 Bytes  [A5, 5F] {MOVSD ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!TerminateProcess                                  7C801E1A 6 Bytes  JMP 5F5F0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!CreateFileMappingW                                7C80943C 6 Bytes  JMP 5F680F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!MapViewOfFileEx                                   7C80B936 6 Bytes  JMP 5F620F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!CreateRemoteThread                                7C8104CC 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!CreateRemoteThread + 4                            7C8104D0 2 Bytes  [6C, 5F] {INSB ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!MoveFileWithProgressW                             7C81F72E 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!MoveFileWithProgressW + 4                         7C81F732 2 Bytes  [6F, 5F] {OUTSD ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] kernel32.dll!CopyFileExW                                       7C827B32 6 Bytes  JMP 5F650F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!DispatchMessageW                                    7E368A01 6 Bytes  JMP 5FDD0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!TranslateMessage                                    7E368BF6 6 Bytes  JMP 5FBC0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!PostMessageW                                        7E368CCB 6 Bytes  JMP 5FCE0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!DispatchMessageA                                    7E3696B8 6 Bytes  JMP 5FB90F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!CreateAcceleratorTableW                             7E36D9BB 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!CreateAcceleratorTableW + 4                         7E36D9BF 2 Bytes  [D8, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!SetWindowsHookExW                                   7E37820F 6 Bytes  JMP 5FDA0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!GetKeyState                                         7E379ED9 6 Bytes  JMP 5FC80F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!GetAsyncKeyState                                    7E37A78F 6 Bytes  JMP 5FBF0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!PostMessageA                                        7E37AAFD 6 Bytes  JMP 5FD10F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!BeginDeferWindowPos                                 7E37AFB9 6 Bytes  JMP 5FB60F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!GetKeyboardState                                    7E37D226 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!GetKeyboardState + 4                                7E37D22A 2 Bytes  [C6, 5F]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!SetClipboardData                                    7E380F9E 6 Bytes  JMP 5FE00F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!SetWindowsHookExA                                   7E381211 6 Bytes  JMP 5FB30F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!SetWinEventHook                                     7E3817F7 6 Bytes  JMP 5FD40F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!AttachThreadInput                                   7E381E52 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!AttachThreadInput + 4                               7E381E56 2 Bytes  [C3, 5F] {RET ; POP EDI}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] USER32.dll!DdeConnect                                          7E3A81C3 6 Bytes  JMP 5FCB0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!CloseServiceHandle                                77DD6CE5 6 Bytes  JMP 5F3E0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!OpenServiceW                                      77DD6FFD 6 Bytes  JMP 5F500F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!StartServiceA                                     77DDFB58 6 Bytes  JMP 5F530F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!StartServiceW                                     77DE3E94 6 Bytes  JMP 5F560F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!ControlService                                    77DE4A09 6 Bytes  JMP 5F410F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!OpenServiceA                                      77DE4C66 6 Bytes  JMP 5F4D0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!LsaAddAccountRights                               77E0ABF1 6 Bytes  JMP 5F590F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!LsaRemoveAccountRights                            77E0AC91 6 Bytes  JMP 5F5C0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!ChangeServiceConfigA                              77E26E69 6 Bytes  JMP 5F320F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!ChangeServiceConfigW                              77E27001 6 Bytes  JMP 5F350F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!ChangeServiceConfig2A                             77E27101 6 Bytes  JMP 5F380F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!ChangeServiceConfig2W                             77E27189 3 Bytes  [FF, 25, 1E]
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!ChangeServiceConfig2W + 4                         77E2718D 2 Bytes  [3C, 5F] {CMP AL, 0x5f}
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!CreateServiceA                                    77E27211 6 Bytes  JMP 5F440F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!CreateServiceW                                    77E273A9 6 Bytes  JMP 5F470F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ADVAPI32.dll!DeleteService                                     77E274B1 6 Bytes  JMP 5F4A0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ole32.dll!CLSIDFromProgID                                      775087F2 6 Bytes  JMP 5FB00F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] ole32.dll!CLSIDFromProgIDEx                                    7754620D 6 Bytes  JMP 5FAD0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] WS2_32.dll!sendto                                              71A52F51 6 Bytes  JMP 5F100F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] WS2_32.dll!recvfrom                                            71A52FF7 6 Bytes  JMP 5F0A0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] WS2_32.dll!closesocket                                         71A53E2B 6 Bytes  JMP 5F2F0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] WS2_32.dll!connect                                             71A54A07 6 Bytes  JMP 5F040F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] WS2_32.dll!send                                                71A54C27 6 Bytes  JMP 5F0D0F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[4084] WS2_32.dll!WSARecv                                             71A54CB5 6 Bytes  JMP 5F160F5A 
.text           C:\Documents and Settings\Przereklamowany\Ustawienia lokalne\Dane aplikacji\Google