GMER 1.0.15.15570 - http://www.gmer.net Rootkit scan 2011-03-29 20:25:46 Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS541680J9SA00 rev.SB2OC7DP Running: mbv4de0i.exe; Driver: C:\Users\justyna\AppData\Local\Temp\fxlirfow.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwAlpcConnectPort [0x8B720570] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwAlpcCreatePort [0x8B720E46] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0x8B71FFC6] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0x8B719884] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0x8B73AFA8] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0x8B720AD0] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0x8B734E42] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0x8B73526A] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0x8B73F6FE] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0x8B720C2E] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0x8B71A5B4] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0x8B73CA50] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0x8B73C346] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0x8B733C26] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0x8B73D41A] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0x8B73D658] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKeyEx [0x8B73DB0A] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0x8B71A16C] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0x8B737358] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenThread [0x8B736F46] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0x8B73E4E0] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0x8B73DDD4] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0x8B71FB5E] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0x8B73EF40] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0x8B720292] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0x8B71A9BE] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0x8B73EA68] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0x8B73BA6A] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0x8B735F66] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0x8B735C96] SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateUserProcess [0x8B7356DE] ---- Kernel code sections - GMER 1.0.15 ---- .text ntoskrnl.exe!KeInsertQueue + 32D 81CA28F4 8 Bytes [70, 05, 72, 8B, 46, 0E, 72, ...] {JO 0x7; JB 0xffffffffffffff8f; INC ESI; PUSH CS; JB 0xffffffffffffff93} .text ntoskrnl.exe!KeInsertQueue + 3B1 81CA2978 4 Bytes CALL F3C9EFFE .text ntoskrnl.exe!KeInsertQueue + 3C9 81CA2990 4 Bytes [84, 98, 71, 8B] .text ntoskrnl.exe!KeInsertQueue + 3D9 81CA29A0 4 Bytes [A8, AF, 73, 8B] {TEST AL, 0xaf; JAE 0xffffffffffffff8f} .text ntoskrnl.exe!KeInsertQueue + 3F5 81CA29BC 12 Bytes [D0, 0A, 72, 8B, 42, 4E, 73, ...] {ROR BYTE [EDX], 0x1; JB 0xffffffffffffff8f; INC EDX; DEC ESI; JAE 0xffffffffffffff93; PUSH 0x52; JAE 0xffffffffffffff97} .text ... ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] kernel32.dll!SetUnhandledExceptionFilter 76846E2D 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wininit.exe[532] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\services.exe[616] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsass.exe[636] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\lsm.exe[644] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[812] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[872] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[908] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[992] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[1060] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1076] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1180] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1232] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1376] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\taskeng.exe[1488] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1804] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[1860] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1924] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1924] USER32.dll!EnumDisplayDevicesW + 9D 7656DE99 5 Bytes JMP 20C79270 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\spoolsv.exe[1996] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\svchost.exe[2040] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\svchost.exe[2088] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] kernel32.dll!SetUnhandledExceptionFilter 76846E2D 5 Bytes JMP 209B37DD C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[2104] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\SearchIndexer.exe[2136] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] user32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] user32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxtray.exe[2836] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\hkcmd.exe[2856] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\System32\igfxpers.exe[2864] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Winamp\winampa.exe[2960] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2996] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Gadu-Gadu\gg.exe[3080] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Skype\Phone\Skype.exe[3096] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] kernel32.dll!SetUnhandledExceptionFilter 76846E2D 5 Bytes JMP 209B37DD C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!closesocket 75E0330C 5 Bytes JMP 20AE3BA8 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!recv 75E0343A 5 Bytes JMP 20AE3C29 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!WSASend 75E04496 5 Bytes JMP 20AE3F07 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!send 75E0659B 5 Bytes JMP 20AE3CD3 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!sendto 75E067C5 5 Bytes JMP 20AE3D71 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!WSARecv 75E08400 5 Bytes JMP 20AE3E15 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!WSASendDisconnect 75E1A3E9 5 Bytes JMP 20AE409B C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] WS2_32.dll!WSASendTo 75E1A474 5 Bytes JMP 20AE3FCE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] USER32.dll!EnumDisplayDevicesW + 9D 7656DE99 5 Bytes JMP 20C79270 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Mozilla Firefox\firefox.exe[3676] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Users\justyna\Desktop\mbv4de0i.exe[4848] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] ntdll.dll!NtAccessCheckByType 777A78E8 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] ntdll.dll!NtAlpcImpersonateClientOfPort 777A7AB8 5 Bytes JMP 20C78DD9 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] ntdll.dll!NtImpersonateClientOfPort 777A8288 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] ntdll.dll!NtSetInformationProcess 777A8BC8 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] kernel32.dll!OpenProcess 76868C95 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] USER32.dll!FindWindowA 76569DB7 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] USER32.dll!FindWindowW 76579949 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] ADVAPI32.dll!ImpersonateNamedPipeClient 76611C2E 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Windows\system32\wuauclt.exe[5640] ADVAPI32.dll!SetThreadToken 766206A3 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [8B71B86C] \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [8B71BAB6] \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [8B71B6BE] \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[288] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\wininit.exe[532] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\services.exe[616] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\lsass.exe[636] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\lsm.exe[644] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[812] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[872] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\svchost.exe[908] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\svchost.exe[992] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\svchost.exe[1060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[1076] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1108] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[1180] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1188] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[1232] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[1376] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\taskeng.exe[1488] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[1804] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[1860] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\spoolsv.exe[1996] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\svchost.exe[2040] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\svchost.exe[2088] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\SearchIndexer.exe[2136] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Skype\Plugin Manager\skypePM.exe[2600] @ C:\Windows\system32\user32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\igfxtray.exe[2836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\hkcmd.exe[2856] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\System32\igfxpers.exe[2864] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2884] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2944] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Winamp\winampa.exe[2960] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Gadu-Gadu\gg.exe[3080] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Skype\Phone\Skype.exe[3096] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Synaptics\SynTP\SynToshiba.exe[3228] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Windows Media Player\wmpnscfg.exe[3328] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Windows Media Player\wmpnetwk.exe[3376] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Mozilla Firefox\firefox.exe[3676] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Users\justyna\Desktop\mbv4de0i.exe[4848] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Windows\system32\wuauclt.exe[5640] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) AttachedDevice \Driver\tdx \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET) ---- EOF - GMER 1.0.15 ----