GMER 1.0.15.15627 - http://www.gmer.net Rootkit scan 2011-05-19 15:43:22 Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_HM080II rev.YE100-15 Running: gmer.exe; Driver: C:\DOCUME~1\AGNIES~1\USTAWI~1\Temp\fwddqkob.sys ---- System - GMER 1.0.15 ---- SSDT 82013580 ZwAssignProcessToJobObject SSDT 82014100 ZwDebugActiveProcess SSDT 82013B30 ZwDuplicateObject SSDT 82012CC0 ZwOpenProcess SSDT 82012FC0 ZwOpenThread SSDT 820139C0 ZwProtectVirtualMemory SSDT 82013860 ZwSetContextThread SSDT 820136E0 ZwSetInformationThread SSDT 82010700 ZwSetSecurityObject SSDT 82013420 ZwSuspendProcess SSDT 820132C0 ZwSuspendThread SSDT 82012E50 ZwTerminateProcess SSDT 82013150 ZwTerminateThread SSDT 82013F50 ZwWriteVirtualMemory ---- User code sections - GMER 1.0.15 ---- .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe[248] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[268] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\totalcmd\TOTALCMD.EXE[444] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\All Users\Dane aplikacji\Mobile Partner\OnlineUpdate\ouc.exe[564] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[584] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[644] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[888] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[932] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[944] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1160] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1196] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1236] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\System32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1292] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1328] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1348] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1480] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1508] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1732] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1856] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1960] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1980] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe[2020] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[2272] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\rundll32.exe[2508] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\stsystra.exe[2516] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2576] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2592] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\igfxpers.exe[2640] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[2656] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\dla\tfswctrl.exe[2712] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2812] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 00986DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 009872BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 00985BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 0098737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 0098724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 00985AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009873E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 00986C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 0098595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 009861DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 009865B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 00986AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 0098633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 00986261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 009862BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00986035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 009866AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 00986A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 009859B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 009864E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 00986EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 00986F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 00986725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 00987202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 00985C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 00985BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 0098718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 00986BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 0098644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 009869D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00986135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 00987001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 00986D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 00985E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 00986E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 00985F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 00985A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 00987108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 00987236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe[2888] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 009871E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[2900] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 00936DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 009372BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 00935BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 0093737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 0093724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 00935AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009373E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 00936C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 0093595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 009361DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 009365B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 00936AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 0093633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 00936261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 009362BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00936035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 009366AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 00936A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 009359B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 009364E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 00936EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 00936F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 00936725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 00937202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 00935C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 00935BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 0093718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 00936BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 0093644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 009369D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00936135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 00937001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 00936D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 00935E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 00936E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 00935F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 00935A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 00937108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 00937236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[3016] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 009371E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3104] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Apoint\Apntex.exe[3112] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe[3124] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3240] ole32.dll!OleLoadFromStream 7751981B 5 Bytes JMP 7E2A546D C:\WINDOWS\system32\SHDOCVW.dll (Biblioteka powłoki obiektów DocObject i formantów/Microsoft Corporation) .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 00966DCE C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 009672BA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 00965BBB C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 0096737D C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 0096724D C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 00965AF1 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009673E3 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 00966C79 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 0096595F C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 009661DA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 009665B6 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 00966AEA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 0096633F C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 00966261 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 009662BB C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00966035 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 009666AD C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 00966A54 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 009659B9 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 009664E4 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 00966EA5 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 00966F53 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 00966725 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 00967202 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 00965C61 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 00965BDA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 0096718A C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 00966BE5 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 0096644C C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 009669D0 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00966135 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 00967001 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 00966D63 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 00965E5A C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 00966E31 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 00965F4C C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 00965A83 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 00967108 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 00967236 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3512] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 009671E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\DllHost.exe[3556] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[3624] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!ReadFile 7C801812 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!CreateFileMappingW 7C80943C 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!CloseHandle 7C809BE7 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetDriveTypeW 7C80B370 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!DuplicateHandle 7C80DE9E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!FindClose 7C80EE77 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetFileSizeEx 7C810AA9 1 Byte [E9] .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetFileSizeEx 7C810AA9 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetFileInformationByHandle 7C810D0D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetLongPathNameW 7C8133F3 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetShortPathNameW 7C81F26E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!SetFilePointerEx 7C821057 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetOverlappedResult 7C8315CC 1 Byte [E9] .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetOverlappedResult 7C8315CC 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!SetEndOfFile 7C832076 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!FlushViewOfFile 7C8359A1 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!RemoveDirectoryW 7C836F8B 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!BackupRead 7C85725A 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!CreateDirectoryExW 7C85B5CA 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!WriteFileEx 7C85D6D9 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!GetCompressedFileSizeW 7C85E349 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] kernel32.dll!CreateHardLinkW 7C86C5AC 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Agnieszka Gola\Pulpit\gmer.exe[3820] USER32.dll!ExitWindowsEx 7E3AA275 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET) AttachedDevice \FileSystem\Ntfs \Ntfs symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft) AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 eamon.sys (Amon monitor/ESET) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 eamon.sys (Amon monitor/ESET) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 eamon.sys (Amon monitor/ESET) Device \FileSystem\Fastfat \Fat A897FD20 AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft) AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET) Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions) Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions) Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions) Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions) Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions) Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\001641a30a3b (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001641a30a3b (not active ControlSet) Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001641a30a3b ---- EOF - GMER 1.0.15 ----