Dll to c
Author: e | 2025-04-24
C: Windows System32 advapi32.dll C: Windows System32 crypt32.dll C: Windows System32 ws2_32.dll C: Windows System32 secur32.dll Microsoft Visual C 2025. MSVCR100.dll / MSVCP100.dll. Microsoft Visual C 2025. MSVCR110.dll / MSVCP110.dll. Microsoft Visual C 2025. MSVCR120.dll / MSVCP120.dll.
DLL to C, DLL, EXE - Dll Decompiler
Bytes JMP 002B0600 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\services.exe[824] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\services.exe[824] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\services.exe[824] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\lsass.exe[836] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\lsass.exe[836] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\lsass.exe[836] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text. C: Windows System32 advapi32.dll C: Windows System32 crypt32.dll C: Windows System32 ws2_32.dll C: Windows System32 secur32.dll Microsoft Visual C 2025. MSVCR100.dll / MSVCP100.dll. Microsoft Visual C 2025. MSVCR110.dll / MSVCP110.dll. Microsoft Visual C 2025. MSVCR120.dll / MSVCP120.dll. The c syntax for declaring an imported function is not available in c. Here are some other SO questions on how to use DLLs: Explicit Loading of DLL; Compile a DLL in C/C, then call it from another program; Calling functions in a DLL from C; Call function in c dll without header; How to use dll's? Is this a good way to use dlls? (C?) MSVCR90.dll Visual C 2025 Redistributable MSVCR100.dll Visual C 2025 Redistributable MSVCR110.dll Visual C 2025 Redistributable MSVCR120.dll Visual C 2025 Redistributable MSVCR140.dll MSVCR90.dll Visual C 2025 Redistributable MSVCR100.dll Visual C 2025 Redistributable MSVCR110.dll Visual C 2025 Redistributable MSVCR120.dll Visual C 2025 Redistributable MSVCR140.dll MSVCR80.dll Visual C 2025 Redistributable MSVCR90.dll Visual C 2025 Redistributable MSVCR100.dll Visual C 2025 Redistributable MSVCR110.dll Visual C 2025 Redistributable MSVCR120.dll MSVCR90.dll Visual C 2025 Redistributable MSVCR100.dll Visual C 2025 Redistributable MSVCR110.dll Visual C 2025 Redistributable MSVCR120.dll Visual C 2025 Redistributable MSVCR140.dll MSVCR80.dll Visual C 2025 Redistributable MSVCR90.dll Visual C 2025 Redistributable MSVCR100.dll Visual C 2025 Redistributable MSVCR110.dll Visual C 2025 Redistributable MSVCR120.dll 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\System32\svchost.exe[1208] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\svchost.exe[1248] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001501F8 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\Ati2evxx.exe[1284] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001503FC .text C:\WINDOWS\system32\Ati2evxx.exe[1284] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00390804 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00390A08 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00390600 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003901F8 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003903FC .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 003A1014 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 003A0804 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 003A0A08 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 003A0C0C .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMPComments
Bytes JMP 002B0600 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\winlogon.exe[780] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\services.exe[824] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\services.exe[824] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\services.exe[824] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\services.exe[824] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\lsass.exe[836] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\lsass.exe[836] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\lsass.exe[836] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\lsass.exe[836] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text
2025-03-2577E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\System32\svchost.exe[1208] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\System32\svchost.exe[1208] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\svchost.exe[1248] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001501F8 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\Ati2evxx.exe[1284] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001503FC .text C:\WINDOWS\system32\Ati2evxx.exe[1284] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00390804 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00390A08 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00390600 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003901F8 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003903FC .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 003A1014 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 003A0804 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 003A0A08 .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 003A0C0C .text C:\WINDOWS\system32\Ati2evxx.exe[1284] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP
2025-04-06Ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\spoolsv.exe[196] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\spoolsv.exe[196] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\spoolsv.exe[196] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\spoolsv.exe[196] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\spoolsv.exe[196] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\spoolsv.exe[196] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\spoolsv.exe[196] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\spoolsv.exe[196] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\spoolsv.exe[196] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\Documents and Settings\John\Desktop\0u2lzmqd.exe[268] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\Documents and Settings\John\Desktop\0u2lzmqd.exe[268] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\RTHDCPL.EXE[420] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001401F8 .text C:\WINDOWS\RTHDCPL.EXE[420] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\RTHDCPL.EXE[420] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001403FC .text C:\WINDOWS\RTHDCPL.EXE[420] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\RTHDCPL.EXE[420] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00380804 .text C:\WINDOWS\RTHDCPL.EXE[420] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00380A08 .text C:\WINDOWS\RTHDCPL.EXE[420] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00380600 .text C:\WINDOWS\RTHDCPL.EXE[420] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003801F8 .text C:\WINDOWS\RTHDCPL.EXE[420] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003803FC .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 00391014 .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 00390804 .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 00390A08 .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 00390C0C .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 00390E10 .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003901F8 .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003903FC .text C:\WINDOWS\RTHDCPL.EXE[420] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 00390600 .text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[436] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte
2025-04-15C:\WINDOWS\system32\lsass.exe[836] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC .text C:\Program Files\Alwil Software\Avast5\avastUI.exe[900] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\Program Files\Alwil Software\Avast5\avastUI.exe[900] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\Ati2evxx.exe[1004] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001501F8 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\Ati2evxx.exe[1004] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001503FC .text C:\WINDOWS\system32\Ati2evxx.exe[1004] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\Ati2evxx.exe[1004] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00390804 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00390A08 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00390600 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003901F8 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003903FC .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 003A1014 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 003A0804 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 003A0A08 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 003A0C0C .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 003A0E10 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003A01F8 .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003A03FC .text C:\WINDOWS\system32\Ati2evxx.exe[1004] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 003A0600 .text C:\WINDOWS\system32\svchost.exe[1024] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\system32\svchost.exe[1024] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\system32\svchost.exe[1024] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600 .text C:\WINDOWS\system32\svchost.exe[1024] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804 .text C:\WINDOWS\system32\svchost.exe[1024] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08 .text C:\WINDOWS\system32\svchost.exe[1024] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600 .text C:\WINDOWS\system32\svchost.exe[1024] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8 .text
2025-04-21