System affected with virus
Second part of Gmer log:
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!PostMessageA + 2 76C4F8FA 5 Bytes JMP 5FF37D08 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendMessageA + 2 76C4F958 7 Bytes JMP 5FF37A50 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendMessageTimeoutW + 2 76C5352F 5 Bytes JMP 5FF3868C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendMessageCallbackW + 2 76C54572 5 Bytes JMP 5FF383D4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!PostThreadMessageW 76C57C8E 5 Bytes JMP 5FF3811C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!PostMessageW + 2 76C5A177 6 Bytes JMP 5FF37E64 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendMessageW + 2 76C60AEF 7 Bytes JMP 5FF37BAC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendDlgItemMessageA + 2 76C6275D 7 Bytes JMP 5FF38AA0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!OpenClipboard + 2 76C6C31F 7 Bytes JMP 5FF3495C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendNotifyMessageA + 2 76C6DFD1 6 Bytes JMP 5FF387E8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendMessageTimeoutA + 2 76C70008 5 Bytes JMP 5FF38530 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendDlgItemMessageW + 2 76C70E3A 7 Bytes JMP 5FF38BFC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SetWindowsHookA + 2 76C8624B 5 Bytes JMP 5FF3CFFC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SetWindowsHookW + 2 76C86266 5 Bytes JMP 5FF3D158 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!EndTask + 2 76C8AD34 6 Bytes JMP 5FF378F4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!ExitWindowsEx + 2 76C8B7C5 6 Bytes JMP 5FF3DEF4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!BroadcastSystemMessageExA + 2 76CA28E5 5 Bytes JMP 5FF39010 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!BroadcastSystemMessage + 2 76CA290C 5 Bytes JMP 5FF38D58 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] USER32.dll!SendMessageCallbackA + 2 76CA2CA9 5 Bytes JMP 5FF38278 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] ole32.dll!CoGetClassObject + 2 7595FAEA 8 Bytes JMP 5FF343EC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] ole32.dll!CoCreateInstanceEx + 2 75979F83 7 Bytes JMP 5FF34290 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] ole32.dll!CoInitializeEx + 2 7597ADFD 5 Bytes JMP 5FF34134 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] ole32.dll!CoGetInstanceFromFile + 2 759CC597 8 Bytes JMP 5FF34548 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\Dwm.exe[2856] ole32.dll!CoGetInstanceFromIStorage + 2 759E87CF 8 Bytes JMP 5FF346A4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!TerminateProcess + 2 768118F1 7 Bytes JMP 5FF3763B C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!CreateProcessW + 2 76811BF5 8 Bytes JMP 5FF36E0F C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!CreateProcessA + 2 76811C2A 8 Bytes JMP 5FF36CB3 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!WriteProcessMemory 76811CB8 5 Bytes JMP 5FF3C678 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!VirtualProtect + 2 76811DC5 6 Bytes JMP 5FF3CBE7 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!LoadLibraryExW 7683927C 12 Bytes JMP 5FF365E5 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!OpenThread + 2 7683C8EE 6 Bytes JMP 5FF3D2B3 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!VirtualProtectEx + 2 7683DC54 10 Bytes JMP 5FF3CA8B C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!FreeLibrary + 2 76853FA6 7 Bytes JMP 5FF369FB C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!ExitProcess + 1 768543F5 11 Bytes JMP 5FF3689E C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!TerminateThread + 2 76854415 6 Bytes JMP 5FF37797 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!GetProcAddress + 2 7685925D 6 Bytes JMP 5FF36743 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!VirtualAllocEx + 2 7685AF1E 7 Bytes JMP 5FF3C92F C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!CreateRemoteThread 7685CB55 10 Bytes JMP 5FF3C7D1 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] kernel32.dll!DebugActiveProcess + 2 76899BC3 8 Bytes JMP 5FF3D40F C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!StartServiceA 7674A24D 12 Bytes JMP 5FF39F05 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!CreateProcessAsUserA + 2 7674CEBB 7 Bytes JMP 5FF37224 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!SetFileSecurityW + 2 7674EC00 6 Bytes JMP 5FF3BCF3 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!SetSecurityInfo + 2 76755896 6 Bytes JMP 5FF3C107 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!SetNamedSecurityInfoW + 2 76755958 6 Bytes JMP 5FF3C3BF C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!CreateProcessAsUserW + 2 76761EEB 6 Bytes JMP 5FF370C8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!OpenSCManagerA 76762D93 12 Bytes JMP 5FF39581 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!OpenServiceA 76762EBD 4 Bytes [8B, FF, 90, E9]
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!OpenServiceA + 5 76762EC2 7 Bytes JMP 0706BF57
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!StartServiceW 76763E0B 12 Bytes JMP 5FF3A061 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!SetKernelObjectSecurity + 2 76763ED0 6 Bytes JMP 5FF3BE4F C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!QueryServiceStatusEx 76764FFE 12 Bytes JMP 5FF3A319 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!QueryServiceConfigW 767650A4 12 Bytes JMP 5FF3A72D C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!QueryServiceConfigA 767651AD 12 Bytes JMP 5FF3A5D1 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!OpenSCManagerW 76767137 12 Bytes JMP 5FF396DD C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!OpenServiceW 76768354 12 Bytes JMP 5FF39C4D C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!QueryServiceStatus 7676842C 12 Bytes JMP 5FF3A1BD C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!AdjustTokenPrivileges + 2 767699CF 7 Bytes JMP 5FF3BA3C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!CreateServiceW 76789EB4 7 Bytes JMP 5FF39996 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!ControlService 76789FB8 7 Bytes JMP 5FF3A476 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!DeleteService 7678A07E 7 Bytes JMP 5FF39DAA C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!EnumServicesStatusExA 7678B31B 7 Bytes JMP 5FF3B622 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!CreateProcessWithLogonW + 2 767A80C3 6 Bytes JMP 5FF36F6C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!InitiateSystemShutdownW + 2 767C182B 6 Bytes JMP 5FF3D827 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!InitiateSystemShutdownExW + 2 767C18F3 6 Bytes JMP 5FF3DADF C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!AbortSystemShutdownW + 2 767C1B14 7 Bytes JMP 5FF3DD98 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!EnumServicesStatusExW 767C6909 7 Bytes JMP 5FF3B77E C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!EnumServicesStatusA 767C6B47 7 Bytes JMP 5FF3B36A C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!SetServiceObjectSecurity 767C6CD9 12 Bytes JMP 5FF3BFA9 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!ChangeServiceConfigA 767C6DD9 7 Bytes JMP 5FF3ADFA C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!ChangeServiceConfigW 767C6F81 7 Bytes JMP 5FF3AF56 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!ChangeServiceConfig2A 767C7099 7 Bytes JMP 5FF3B0B2 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!ChangeServiceConfig2W 767C71E1 7 Bytes JMP 5FF3B20E C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!CreateServiceA 767C72A1 7 Bytes JMP 5FF3983A C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!EnumDependentServicesA 767C7505 7 Bytes JMP 5FF3AB42 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!EnumDependentServicesW 767C75D9 7 Bytes JMP 5FF3AC9E C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!QueryServiceConfig2A 767C7891 12 Bytes JMP 5FF3A889 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!QueryServiceConfig2W 767C7A19 12 Bytes JMP 5FF3A9E5 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ADVAPI32.dll!EnumServicesStatusW + 2 767C7F63 5 Bytes JMP 5FF3B4C8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SetUserObjectSecurity 76C4280F 5 Bytes JMP 5FF3C51C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SetWindowsHookExA 76C46322 5 Bytes JMP 5FF3CD44 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!BroadcastSystemMessageW 76C4813F 5 Bytes JMP 5FF38EB4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SetWindowsHookExW 76C487AD 5 Bytes JMP 5FF3CEA0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendNotifyMessageW 76C493D6 5 Bytes JMP 5FF38944 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!BroadcastSystemMessageExW 76C49419 5 Bytes JMP 5FF3916C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!PostThreadMessageA 76C4BD34 5 Bytes JMP 5FF37FC0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!PostMessageA 76C4F8F8 5 Bytes JMP 5FF37D08 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendMessageA 76C4F956 5 Bytes JMP 5FF37A50 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendMessageTimeoutW 76C5352D 5 Bytes JMP 5FF3868C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendMessageCallbackW 76C54570 5 Bytes JMP 5FF383D4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!PostThreadMessageW 76C57C8E 5 Bytes JMP 5FF3811C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!PostMessageW 76C5A175 5 Bytes JMP 5FF37E64 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendMessageW 76C60AED 5 Bytes JMP 5FF37BAC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendDlgItemMessageA 76C6275B 5 Bytes JMP 5FF38AA0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!OpenClipboard 76C6C31D 5 Bytes JMP 5FF3495C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendNotifyMessageA 76C6DFCF 5 Bytes JMP 5FF387E8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendMessageTimeoutA 76C70006 5 Bytes JMP 5FF38530 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendDlgItemMessageW 76C70E38 5 Bytes JMP 5FF38BFC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SetWindowsHookA 76C86249 5 Bytes JMP 5FF3CFFC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SetWindowsHookW 76C86264 5 Bytes JMP 5FF3D158 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!EndTask 76C8AD32 5 Bytes JMP 5FF378F4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!ExitWindowsEx 76C8B7C3 5 Bytes JMP 5FF3DEF4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!BroadcastSystemMessageExA 76CA28E3 5 Bytes JMP 5FF39010 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!BroadcastSystemMessage 76CA290A 5 Bytes JMP 5FF38D58 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendMessageCallbackA 76CA2CA7 2 Bytes JMP 5FF38278 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] USER32.dll!SendMessageCallbackA + 3 76CA2CAA 2 Bytes [29, E9] {SUB ECX, EBP}
.text C:\Windows\Explorer.EXE[2968] SHELL32.dll!SHCreateProcessAsUserW 75E399C3 8 Bytes JMP 5FF37380 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ole32.dll!CoGetClassObject 7595FAE8 1 Byte [E9]
.text C:\Windows\Explorer.EXE[2968] ole32.dll!CoGetClassObject 7595FAE8 5 Bytes JMP 5FF343EC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ole32.dll!CoCreateInstanceEx 75979F81 5 Bytes JMP 5FF34290 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ole32.dll!CoInitializeEx 7597ADFB 5 Bytes JMP 5FF34134 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ole32.dll!CoGetInstanceFromFile 759CC595 5 Bytes JMP 5FF34548 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\Explorer.EXE[2968] ole32.dll!CoGetInstanceFromIStorage 759E87CD 5 Bytes JMP 5FF346A4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] kernel32.dll!CreateProcessW + 2 76811BF5 8 Bytes JMP 5FF36E0F C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] kernel32.dll!CreateProcessA + 2 76811C2A 8 Bytes JMP 5FF36CB3 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] kernel32.dll!LoadLibraryExW 7683927C 12 Bytes JMP 5FF365E5 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] kernel32.dll!FreeLibrary + 2 76853FA6 7 Bytes JMP 5FF369FB C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] kernel32.dll!ExitProcess + 1 768543F5 11 Bytes JMP 5FF3689E C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] kernel32.dll!GetProcAddress + 2 7685925D 6 Bytes JMP 5FF36743 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] ADVAPI32.dll!CreateProcessAsUserA + 2 7674CEBB 7 Bytes JMP 5FF37223 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] ADVAPI32.dll!CreateProcessAsUserW + 2 76761EEB 6 Bytes JMP 5FF370C7 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe[3484] ADVAPI32.dll!CreateProcessWithLogonW + 2 767A80C3 6 Bytes JMP 5FF36F6B C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] kernel32.dll!CreateProcessW + 2 76811BF5 8 Bytes JMP 5FF36E0F C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] kernel32.dll!CreateProcessA + 2 76811C2A 8 Bytes JMP 5FF36CB3 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] kernel32.dll!LoadLibraryExW 7683927C 12 Bytes JMP 5FF365E5 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] kernel32.dll!FreeLibrary + 2 76853FA6 7 Bytes JMP 5FF369FB C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] kernel32.dll!ExitProcess + 1 768543F5 11 Bytes JMP 5FF3689E C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] kernel32.dll!GetProcAddress + 2 7685925D 6 Bytes JMP 5FF36743 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] ADVAPI32.dll!CreateProcessAsUserA + 2 7674CEBB 7 Bytes JMP 5FF37223 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] ADVAPI32.dll!CreateProcessAsUserW + 2 76761EEB 6 Bytes JMP 5FF370C7 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] ADVAPI32.dll!CreateProcessWithLogonW + 2 767A80C3 6 Bytes JMP 5FF36F6B C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\System32\mdmcls32.exe[3644] SHELL32.dll!SHCreateProcessAsUserW 75E399C3 8 Bytes JMP 5FF3737D C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] kernel32.dll!CreateProcessW + 2 76811BF5 5 Bytes JMP 5FF36E10 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] kernel32.dll!CreateProcessA + 2 76811C2A 5 Bytes JMP 5FF36CB4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] kernel32.dll!LoadLibraryExW 7683927C 7 Bytes JMP 5FF365E6 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] kernel32.dll!FreeLibrary + 2 76853FA6 7 Bytes JMP 5FF369FC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] kernel32.dll!ExitProcess + 1 768543F5 6 Bytes JMP 5FF3689F C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] kernel32.dll!GetProcAddress + 2 7685925D 5 Bytes JMP 5FF36744 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] ADVAPI32.dll!CreateProcessAsUserA + 2 7674CEBB 7 Bytes JMP 5FF37224 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] ADVAPI32.dll!CreateProcessAsUserW + 2 76761EEB 6 Bytes JMP 5FF370C8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] ADVAPI32.dll!CreateProcessWithLogonW + 2 767A80C3 6 Bytes JMP 5FF36F6C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Windows\system32\SearchIndexer.exe[3952] SHELL32.dll!SHCreateProcessAsUserW 75E399C3 8 Bytes JMP 5FF3737E C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!TerminateProcess 768118EF 5 Bytes JMP 5FF3763C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!CreateProcessW 76811BF3 5 Bytes JMP 5FF36E10 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!CreateProcessA 76811C28 5 Bytes JMP 5FF36CB4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!WriteProcessMemory 76811CB8 5 Bytes JMP 5FF3C678 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!VirtualProtect 76811DC3 5 Bytes JMP 5FF3CBE8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!LoadLibraryExW 7683927C 7 Bytes JMP 5FF365E8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!OpenThread 7683C8EC 5 Bytes JMP 5FF3D2B4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!VirtualProtectEx 7683DC52 5 Bytes JMP 5FF3CA8C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!FreeLibrary 76853FA4 5 Bytes JMP 5FF369FC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!ExitProcess 768543F4 5 Bytes JMP 5FF368A0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!TerminateThread 76854413 5 Bytes JMP 5FF37798 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!GetProcAddress 7685925B 5 Bytes JMP 5FF36744 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!VirtualAllocEx 7685AF1C 5 Bytes JMP 5FF3C930 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!CreateRemoteThread 7685CB55 5 Bytes JMP 5FF3C7D4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] kernel32.dll!DebugActiveProcess 76899BC1 5 Bytes JMP 5FF3D410 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SetUserObjectSecurity 76C4280F 5 Bytes JMP 5FF3C51C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SetWindowsHookExA 76C46322 5 Bytes JMP 5FF3CD44 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!BroadcastSystemMessageW 76C4813F 5 Bytes JMP 5FF38EB4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SetWindowsHookExW 76C487AD 5 Bytes JMP 5FF3CEA0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendNotifyMessageW 76C493D6 5 Bytes JMP 5FF38944 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!BroadcastSystemMessageExW 76C49419 5 Bytes JMP 5FF3916C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!PostThreadMessageA 76C4BD34 5 Bytes JMP 5FF37FC0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!PostMessageA 76C4F8F8 5 Bytes JMP 5FF37D08 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendMessageA 76C4F956 5 Bytes JMP 5FF37A50 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendMessageTimeoutW 76C5352D 5 Bytes JMP 5FF3868C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendMessageCallbackW 76C54570 5 Bytes JMP 5FF383D4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!PostThreadMessageW 76C57C8E 5 Bytes JMP 5FF3811C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!PostMessageW 76C5A175 5 Bytes JMP 5FF37E64 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendMessageW 76C60AED 5 Bytes JMP 5FF37BAC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendDlgItemMessageA 76C6275B 5 Bytes JMP 5FF38AA0 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!OpenClipboard 76C6C31D 5 Bytes JMP 5FF3495C C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendNotifyMessageA 76C6DFCF 5 Bytes JMP 5FF387E8 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendMessageTimeoutA 76C70006 5 Bytes JMP 5FF38530 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendDlgItemMessageW 76C70E38 5 Bytes JMP 5FF38BFC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SetWindowsHookA 76C86249 5 Bytes JMP 5FF3CFFC C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SetWindowsHookW 76C86264 5 Bytes JMP 5FF3D158 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!EndTask 76C8AD32 5 Bytes JMP 5FF378F4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!ExitWindowsEx 76C8B7C3 5 Bytes JMP 5FF3DEF4 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!BroadcastSystemMessageExA 76CA28E3 5 Bytes JMP 5FF39010 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!BroadcastSystemMessage 76CA290A 5 Bytes JMP 5FF38D58 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendMessageCallbackA 76CA2CA7 2 Bytes JMP 5FF38278 C:\Windows\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe[4176] USER32.dll!SendMessageCallbackA + 3 76CA2CAA 2 Bytes [29, E9] {SUB ECX, EBP}