@keydet89 The article does tell you what hooked function to look for. That at means you could find the malware w/ memory analysis.