Hi
That took forever becasue my computer kept crashing. whenever i turn off Norton its a nightmare. anyway. I wasnt able to do anything in safe mode so here is my GMER log but please note, after 2 trys it seemed to freeze at
\Device\harddiskColumeShadowCopy1
both times, so i dont know what this means
GMER 1.0.15.15315 -
http://www.gmer.net
Rootkit scan 2010-10-14 16:24:24
Windows 6.0.6002 Service Pack 2
Running: b4p32vi8.exe; Driver: C:\Users\GINATR~1\AppData\Local\Temp\axxcquob.sys
—- System - GMER 1.0.15 —-
SSDT 95123020 ZwAlertResumeThread
SSDT 955DD348 ZwAlertThread
SSDT 9D770728 ZwAllocateVirtualMemory
SSDT 8958AB80 ZwAlpcConnectPort
SSDT 9D2B1048 ZwAssignProcessToJobObject
SSDT 9D7796B0 ZwCreateMutant
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x85A7A282]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x85A7A474]
SSDT 9D7892D0 ZwCreateSymbolicLinkObject
SSDT 9D774300 ZwCreateThread
SSDT 951E2048 ZwDebugActiveProcess
SSDT 9D773138 ZwDuplicateObject
SSDT 9D774958 ZwFreeVirtualMemory
SSDT 9510E2A0 ZwImpersonateAnonymousToken
SSDT 9510B110 ZwImpersonateThread
SSDT 894F22F8 ZwLoadDriver
SSDT 9D7747E0 ZwMapViewOfSection
SSDT 955FD048 ZwOpenEvent
SSDT 9D770478 ZwOpenProcess
SSDT 8D16A110 ZwOpenProcessToken
SSDT 951F0048 ZwOpenSection
SSDT 9D773248 ZwOpenThread
SSDT 9D788830 ZwProtectVirtualMemory
SSDT 9D2E4D10 ZwResumeThread
SSDT 8D1FF068 ZwSetContextThread
SSDT 9D774690 ZwSetInformationProcess
SSDT 951BC048 ZwSetSystemInformation
SSDT 951ED048 ZwSuspendProcess
SSDT 8D1BA700 ZwSuspendThread
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0x85A79F32]
SSDT 95135108 ZwTerminateThread
SSDT 8D181110 ZwUnmapViewOfSection
SSDT 9D7744C0 ZwWriteVirtualMemory
SSDT 9D77CEB0 ZwCreateThreadEx
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x85A7A67C]
—- Kernel code sections - GMER 1.0.15 —-
.text ntkrnlpa.exe!KeSetEvent + 11D 84EAC880 1 Byte [20]
.text ntkrnlpa.exe!KeSetEvent + 11D 84EAC880 8 Bytes [20, 30, 12, 95, 48, D3, 5D, …] {AND [EAX], DH; ADC DL, [EBP-0x6aa22cb8]}
.text ntkrnlpa.exe!KeSetEvent + 131 84EAC894 4 Bytes [28, 07, 77, 9D] {SUB [EDI], AL; JA 0xffffffffffffffa1}
.text ntkrnlpa.exe!KeSetEvent + 13D 84EAC8A0 4 Bytes [80, AB, 58, 89]
.text ntkrnlpa.exe!KeSetEvent + 191 84EAC8F4 4 Bytes [48, 10, 2B, 9D] {DEC EAX; ADC [EBX], CH; POPF }
.text …
? C:\Windows\system32\Drivers\mchInjDrv.sys The system cannot find the file specified. !
—- User code sections - GMER 1.0.15 —-
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[188] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[188] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[188] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[188] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\System32\smss.exe[444] ntdll.dll!NtTestAlert 779D5514 1 Byte [50]
.text C:\Windows\System32\smss.exe[444] ntdll.dll!NtTestAlert 779D5514 8 Bytes JMP 71700029
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[512] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\csrss.exe[512] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\csrss.exe[512] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\csrss.exe[512] KERNEL32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wininit.exe[564] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\wininit.exe[564] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wininit.exe[564] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\wininit.exe[564] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\csrss.exe[576] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\csrss.exe[576] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\csrss.exe[576] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\csrss.exe[576] KERNEL32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\winlogon.exe[616] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\winlogon.exe[616] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\winlogon.exe[616] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\winlogon.exe[616] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\services.exe[656] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\services.exe[656] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\services.exe[656] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\services.exe[656] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsass.exe[672] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\lsass.exe[672] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\lsass.exe[672] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\lsass.exe[672] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\lsm.exe[680] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\lsm.exe[680] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\lsm.exe[680] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\lsm.exe[680] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[840] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[840] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[840] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[888] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\nvvsvc.exe[888] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\nvvsvc.exe[888] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\nvvsvc.exe[888] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[920] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[920] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[920] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[920] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1036] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1060] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[1068] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\svchost.exe[1068] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1112] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[1112] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[1112] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\svchost.exe[1112] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1148] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1152] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1152] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1152] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[1152] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1260] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1260] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1260] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[1260] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1272] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1272] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1272] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[1272] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\SLsvc.exe[1288] ntdll.dll!NtTestAlert 779D5514 1 Byte [50]
.text C:\Windows\system32\SLsvc.exe[1288] ntdll.dll!NtTestAlert 779D5514 8 Bytes JMP 71700029
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[1324] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1336] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1336] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1336] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[1336] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\nvvsvc.exe[1404] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\nvvsvc.exe[1404] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\nvvsvc.exe[1404] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\nvvsvc.exe[1404] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Motive\McciCMService.exe[1448] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1452] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Fingerprint Reader Suite\upeksvr.exe[1500] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[1508] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[1512] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\rundll32.exe[1512] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\rundll32.exe[1512] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\rundll32.exe[1512] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1536] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1616] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[1616] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WLANExt.exe[1684] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\WLANExt.exe[1684] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\WLANExt.exe[1684] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\WLANExt.exe[1684] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [15, 5F]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [18, 5F]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [1B, 5F]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [1E, 5F] {PUSH DS; POP EDI}
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [12, 5F]
.text C:\Program Files\Skype\Phone\Skype.exe[1832] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Skype\Phone\Skype.exe[1832] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F040F5A
.text C:\Program Files\Skype\Phone\Skype.exe[1832] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\spoolsv.exe[1940] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\spoolsv.exe[1940] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\spoolsv.exe[1940] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\spoolsv.exe[1940] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1952] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1952] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1952] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[1952] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe[1996] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe[2052] ntdll.dll!NtTestAlert 779D5514 1 Byte [50]
.text C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe[2052] ntdll.dll!NtTestAlert 779D5514 8 Bytes JMP 71700029 C:\Program Files\Norton 360\Engine\4.3.0.5\FWGenPlg.dll (Firewall Generic Plug-in/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2172] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[2172] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[2172] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\svchost.exe[2172] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[2204] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[2204] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[2204] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\svchost.exe[2204] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2216] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[2216] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[2216] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[2216] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[2260] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[2432] ntdll.dll!NtTestAlert 779D5514 1 Byte [50]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[2432] ntdll.dll!NtTestAlert 779D5514 8 Bytes JMP 71700029
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[2432] kernel32.dll!CreateThread + 1A 7608C928 4 Bytes CALL 0044AD11 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2652] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2968] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\OEM02Mon.exe[3000] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\OEM02Mon.exe[3000] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\OEM02Mon.exe[3000] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\OEM02Mon.exe[3000] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[3040] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\iPod\bin\iPodService.exe[3040] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\iPod\bin\iPodService.exe[3040] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\Dwm.exe[3076] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\Dwm.exe[3076] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\Dwm.exe[3076] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\Dwm.exe[3076] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\Explorer.EXE[3148] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\Explorer.EXE[3148] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\Explorer.EXE[3148] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\Explorer.EXE[3148] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3264] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\taskeng.exe[3264] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\taskeng.exe[3264] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\taskeng.exe[3264] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3296] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[3296] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[3296] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\svchost.exe[3296] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3344] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[3344] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[3344] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\svchost.exe[3344] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3352] ntdll.dll!NtTestAlert 779D5514 1 Byte [50]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3352] ntdll.dll!NtTestAlert 779D5514 8 Bytes JMP 71700029
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3352] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3352] kernel32.dll!CreateThread + 1A 7608C928 4 Bytes CALL 0044AB89 C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3352] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F040F5A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3352] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\rundll32.exe[3368] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\System32\rundll32.exe[3368] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\rundll32.exe[3368] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\System32\rundll32.exe[3368] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3408] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3516] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3516] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\SearchIndexer.exe[3516] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\SearchIndexer.exe[3516] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe[3820] ntdll.dll!NtTestAlert 779D5514 1 Byte [50]
.text C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe[3820] ntdll.dll!NtTestAlert 779D5514 8 Bytes JMP 71700029
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[3924] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\taskeng.exe[3924] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\taskeng.exe[3924] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\taskeng.exe[3924] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[3936] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[4456] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Users\Gina Travel laptop\Desktop\b4p32vi8.exe[4524] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[6024] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateProcess 779D4494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateProcess + 4 779D4498 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateProcessEx 779D44A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateProcessEx + 4 779D44A8 2 Bytes [11, 5F]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateSection 779D44C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateSection + 4 779D44C8 2 Bytes [05, 5F]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtTerminateProcess 779D54F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtTerminateProcess + 4 779D54F8 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtWriteVirtualMemory 779D5674 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtWriteVirtualMemory + 4 779D5678 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateUserProcess 779D5804 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\DllHost.exe[6116] ntdll.dll!NtCreateUserProcess + 4 779D5808 2 Bytes [0B, 5F]
.text C:\Windows\system32\DllHost.exe[6116] kernel32.dll!LoadLibraryExW 76069109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\DllHost.exe[6116] USER32.dll!SetWindowsHookExA 776A6322 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\DllHost.exe[6116] USER32.dll!SetWindowsHookExW 776A87AD 6 Bytes JMP 5F1D0F5A
