My RKU log

ok, i quess i have to accept the sad truth that there aint no rootkits or malware in my computer.  btw, is combofix a trustworthy tool as i scanned it in virustotal and it seemed to be detected by many scanners? I would like to try it just for fun...

spybot did not found nothing, super antispyware did not found nothing, avast detected some components belonging to escan that i installed yesterday but removed soon after that because it was unable to scan any files in my computer for some unknown reason, malwarebytes also did not find nothing. Maybe i try the fsecure onlinescanner but i think that the result is propably the same than with the others.

Edited by Creep - 30 December 2008 at 10:47am

ooks

ntoskrnl.exe+0x0006906A, Type: Inline - RelativeJump at address 0x8046906A hook handler located in [ntoskrnl.exe]
tcpip.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xB7BCCC1C hook handler located in [vsdatant.sys]
tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xB7BCCBD4 hook handler located in [vsdatant.sys]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xB7BCCBC8 hook handler located in [vsdatant.sys]
wanarp.sys+0x000067C1, Type: Inline - RelativeJump at address 0xEB6AE7C1 hook handler located in [wanarp.sys]
wanarp.sys+0x000067C5, Type: Inline - RelativeJump at address 0xEB6AE7C5 hook handler located in [unknown_code_page]
wanarp.sys+0x000067CD, Type: Inline - RelativeJump at address 0xEB6AE7CD hook handler located in [wanarp.sys]
wanarp.sys+0x000067D1, Type: Inline - RelativeJump at address 0xEB6AE7D1 hook handler located in [wanarp.sys]
wanarp.sys+0x000067D5, Type: Inline - RelativeJump at address 0xEB6AE7D5 hook handler located in [wanarp.sys]
wanarp.sys+0x000067D9, Type: Inline - RelativeJump at address 0xEB6AE7D9 hook handler located in [serial.sys]
wanarp.sys+0x000067E1, Type: Inline - RelativeJump at address 0xEB6AE7E1 hook handler located in [unknown_code_page]
wanarp.sys+0x000067E9, Type: Inline - RelativeJump at address 0xEB6AE7E9 hook handler located in [wanarp.sys]
wanarp.sys+0x000067ED, Type: Inline - RelativeJump at address 0xEB6AE7ED hook handler located in [wanarp.sys]
wanarp.sys+0x000067F5, Type: Inline - RelativeCall at address 0xEB6AE7F5 hook handler located in [unknown_code_page]
wanarp.sys+0x000067FD, Type: Inline - RelativeCall at address 0xEB6AE7FD hook handler located in [unknown_code_page]
wanarp.sys+0x00006805, Type: Inline - RelativeJump at address 0xEB6AE805 hook handler located in [unknown_code_page]
wanarp.sys+0x0000680D, Type: Inline - RelativeJump at address 0xEB6AE80D hook handler located in [unknown_code_page]
wanarp.sys+0x00006815, Type: Inline - RelativeJump at address 0xEB6AE815 hook handler located in [unknown_code_page]
wanarp.sys+0x0000681D, Type: Inline - RelativeJump at address 0xEB6AE81D hook handler located in [unknown_code_page]
wanarp.sys+0x00006825, Type: Inline - RelativeJump at address 0xEB6AE825 hook handler located in [unknown_code_page]
wanarp.sys+0x0000682D, Type: Inline - RelativeJump at address 0xEB6AE82D hook handler located in [unknown_code_page]
wanarp.sys+0x00006835, Type: Inline - RelativeJump at address 0xEB6AE835 hook handler located in [unknown_code_page]
wanarp.sys+0x0000683D, Type: Inline - RelativeJump at address 0xEB6AE83D hook handler located in [unknown_code_page]
wanarp.sys+0x00006845, Type: Inline - RelativeJump at address 0xEB6AE845 hook handler located in [unknown_code_page]
wanarp.sys+0x0000684D, Type: Inline - RelativeCall at address 0xEB6AE84D hook handler located in [unknown_code_page]
wanarp.sys+0x00006855, Type: Inline - RelativeJump at address 0xEB6AE855 hook handler located in [unknown_code_page]
wanarp.sys+0x0000685D, Type: Inline - RelativeCall at address 0xEB6AE85D hook handler located in [unknown_code_page]
wanarp.sys+0x00006865, Type: Inline - RelativeJump at address 0xEB6AE865 hook handler located in [wanarp.sys]
wanarp.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xEB6AD280 hook handler located in [vsdatant.sys]
wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification at address 0xEB6AD25C hook handler located in [vsdatant.sys]
wanarp.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xEB6AD298 hook handler located in [vsdatant.sys]
wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xEB6AD268 hook handler located in [vsdatant.sys]
[1224]MWASER.EXE-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1224]MWASER.EXE-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1260]MWAGENT.EXE-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[1284]mstask.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1284]mstask.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1284]mstask.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1284]mstask.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1284]mstask.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1284]mstask.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1284]mstask.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1284]mstask.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1284]mstask.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[1284]mstask.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[1284]mstask.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[1284]mstask.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1284]mstask.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1320]SMAgent.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1360]sp_rsser.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[1432]stisvc.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1432]stisvc.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1432]stisvc.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1456]WinMgmt.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[1472]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[1472]svchost.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[1472]svchost.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[1472]svchost.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[1472]svchost.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[1472]svchost.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[1472]svchost.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[1472]svchost.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[1472]svchost.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[1472]svchost.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[1472]svchost.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[1472]svchost.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[1472]svchost.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[200]WINLOGON.EXE-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[204]CSRSS.EXE-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[252]SERVICES.EXE-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[264]LSASS.EXE-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[264]LSASS.EXE-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[264]LSASS.EXE-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[408]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[408]svchost.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[408]svchost.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[408]svchost.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[408]svchost.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[408]svchost.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[408]svchost.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[408]svchost.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[408]svchost.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[576]spoolsv.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[576]spoolsv.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[576]spoolsv.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[600]a2service.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[600]a2service.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[600]a2service.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[600]a2service.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[600]a2service.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[600]a2service.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[600]a2service.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[600]a2service.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[600]a2service.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[600]a2service.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[600]a2service.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[600]a2service.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[600]a2service.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[656]aawservice.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[656]aawservice.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[656]aawservice.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[656]aawservice.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[656]aawservice.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[656]aawservice.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[656]aawservice.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[656]aawservice.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[656]aawservice.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[656]aawservice.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[656]aawservice.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[656]aawservice.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[656]aawservice.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[692]explorer.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[692]explorer.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[692]explorer.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[692]explorer.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[692]explorer.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[692]explorer.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[692]explorer.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[692]explorer.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[692]explorer.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[692]explorer.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[692]explorer.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[692]explorer.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[692]explorer.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[744]prevxcsi.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[800]cisvc.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[800]cisvc.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[800]cisvc.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[800]cisvc.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[800]cisvc.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[800]cisvc.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[800]cisvc.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[800]cisvc.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[800]cisvc.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[856]WinPatrol.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[868]prevxcsi.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]
[924]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - DirectJump at address 0x791B4B39 hook handler located in [unknown_code_page]
[924]svchost.exe-->advapi32.dll-->LsaRemoveAccountRights, Type: Inline - DirectJump at address 0x791AD051 hook handler located in [unknown_code_page]
[924]svchost.exe-->advapi32.dll-->OpenSCManagerA, Type: Inline - DirectJump at address 0x79182E37 hook handler located in [unknown_code_page]
[924]svchost.exe-->advapi32.dll-->RegCreateKeyExA, Type: Inline - DirectJump at address 0x7918D804 hook handler located in [unknown_code_page]
[924]svchost.exe-->advapi32.dll-->RegOpenKeyExA, Type: Inline - DirectJump at address 0x7918F4C0 hook handler located in [unknown_code_page]
[924]svchost.exe-->advapi32.dll-->RegSetValueExA, Type: Inline - DirectJump at address 0x7918E841 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->CreateFileA, Type: Inline - DirectJump at address 0x7955C243 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->CreateFileW, Type: Inline - DirectJump at address 0x7955C275 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->CreateProcessA, Type: Inline - DirectJump at address 0x79565040 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->CreateProcessW, Type: Inline - DirectJump at address 0x79566981 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->CreateRemoteThread, Type: Inline - DirectJump at address 0x7954B412 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->CreateThread, Type: Inline - DirectJump at address 0x7956B87C hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->CreateToolhelp32Snapshot, Type: Inline - DirectJump at address 0x7956CC0E hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->DebugActiveProcess, Type: Inline - DirectJump at address 0x7954FCEF hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->GetProcAddress, Type: Inline - DirectJump at address 0x79560CF7 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->GetVolumeInformationA, Type: Inline - DirectJump at address 0x79563C52 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->LoadLibraryA, Type: Inline - DirectJump at address 0x7956026D hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - DirectJump at address 0x79560595 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->LoadLibraryW, Type: Inline - DirectJump at address 0x7956031E hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->LoadResource, Type: Inline - DirectJump at address 0x79561150 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->TerminateProcess, Type: Inline - DirectJump at address 0x79566A9D hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->TerminateThread, Type: Inline - DirectJump at address 0x7956BB59 hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->VirtualProtect, Type: Inline - DirectJump at address 0x7955E9EE hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->WinExec, Type: Inline - DirectJump at address 0x7956752A hook handler located in [unknown_code_page]
[924]svchost.exe-->kernel32.dll-->WriteProcessMemory, Type: Inline - DirectJump at address 0x79567990 hook handler located in [unknown_code_page]
[924]svchost.exe-->ntdll.dll-->NtLoadDriver, Type: Inline - DirectJump at address 0x77F885BC hook handler located in [unknown_code_page]
[924]svchost.exe-->shell32.dll-->ShellExecuteA, Type: Inline - DirectJump at address 0x7D036B6C hook handler located in [unknown_code_page]
[924]svchost.exe-->shell32.dll-->ShellExecuteEx, Type: Inline - DirectJump at address 0x7CFE961B hook handler located in [unknown_code_page]
[924]svchost.exe-->shell32.dll-->ShellExecuteExW, Type: Inline - DirectJump at address 0x7CFE205D hook handler located in [unknown_code_page]
[924]svchost.exe-->shell32.dll-->ShellExecuteW, Type: Inline - DirectJump at address 0x7D036AF8 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->DdeConnect, Type: Inline - DirectJump at address 0x77E3FE82 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->EndTask, Type: Inline - DirectJump at address 0x77E420FA hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->GetAsyncKeyState, Type: Inline - DirectJump at address 0x77E1A2A0 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->GetKeyState, Type: Inline - DirectJump at address 0x77E165F2 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->GetWindowTextA, Type: Inline - DirectJump at address 0x77E176C6 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - DirectJump at address 0x77E19BE4 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - DirectJump at address 0x77E39C81 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - DirectJump at address 0x77E508C3 hook handler located in [unknown_code_page]
[924]svchost.exe-->user32.dll-->ShowWindow, Type: Inline - DirectJump at address 0x77E1CFBE hook handler located in [unknown_code_page]