Computer Seriously Compromised

Hi spierian,

Those logs show your machine as severely infected, I should tell you that it could take a while to clean this machine, and I hope you took notice of the warning I gave above, if it applies to you the risk is real and the sooner you take precautions the less likely you are to have a problem.

I can help with removing Stopzilla but not until we've cleaned the malware.

With regard to the other computers on your LAN, it's very possible that they are also infected, and there is a risk that the one we are cleaning will be reinfected by the other machine while we are working so it's best to not have them connected to the LAN at the same time. In any case, I strongly recommend you disconnect this machine from the network and the internet when we aren't working on it for now.

If you would like help with another machine then you should post a log with a description of symptoms, probably best done when we are finished with this one.

If you wish to transfer files from this machine to another, you should be able to do so but you must scan everything before it is accessed in any way on the new system. I recommend you use Kaspersky Online Scanner for this job.

Download Gmer to your Desktop from here:
http://www.gmer.net/gmer.zip

• Unzip the program onto your Desktop
• Disconnect from internet and close all running programs
• Double click gmer.exe, let the gmer.sys driver load if asked
• If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say OK
• If no warning….Check that the Rootkit tab is selected and click the Scan button - don't change any settings before you do so
• Once the scan is complete, click the Copy button
• Open Notepad and hit Ctrl+V to paste the log and then save the log to your desktop

Once complete, please post the GMER log and a new HijackThis log.

GMER LOG PART 2 .text C:\Program Files\Panda Software\Panda Internet Security 2007\SrvLoad.exe[1316] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\SrvLoad.exe[1316] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\SrvLoad.exe[1316] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrlS.exe[1324] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrlS.exe[1324] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrlS.exe[1324] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrlS.exe[1324] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe[1376] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe[1376] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe[1376] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe[1376] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\svchost.exe[1432] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\svchost.exe[1432] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\svchost.exe[1432] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\svchost.exe[1432] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\svchost.exe[1432] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1432] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe[1496] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe[1496] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe[1496] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe[1496] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\svchost.exe[1536] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\svchost.exe[1536] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\svchost.exe[1536] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\svchost.exe[1536] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVFNSVR.EXE[1588] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVFNSVR.EXE[1588] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVFNSVR.EXE[1588] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVFNSVR.EXE[1588] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVSRV51.EXE[1660] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVSRV51.EXE[1660] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVSRV51.EXE[1660] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PAVSRV51.EXE[1660] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE[1672] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE[1672] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE[1672] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE[1672] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 76, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 80, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\svchost.exe[1808] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\svchost.exe[1808] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\svchost.exe[1808] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\svchost.exe[1808] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\svchost.exe[1808] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FAC0F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA30F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A7, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F9A0F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ A1, 5F ] .text C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe[1864] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe[1864] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe[1864] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe[1864] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe[1980] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[1988] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\svchost.exe[1988] OLE32.DLL!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\svchost.exe[1988] OLE32.DLL!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\svchost.exe[1988] OLE32.DLL!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\svchost.exe[1988] OLE32.DLL!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe[2224] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe[2224] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe[2224] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe[2224] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqsvc.exe[2356] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\mqsvc.exe[2356] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\mqsvc.exe[2356] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\tcpsvcs.exe[2400] OLE32.DLL!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] OLE32.DLL!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] OLE32.DLL!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\tcpsvcs.exe[2400] OLE32.DLL!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ]

GMER LOG PART 3 .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\Program Files\STOPzilla!\STOPzilla.exe[2416] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\Panda Software\Panda Internet Security 2007\apvxdwin.exe[2492] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\apvxdwin.exe[2492] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\apvxdwin.exe[2492] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\apvxdwin.exe[2492] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe[2712] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\Program Files\WinPortrait\wpctrl.exe[2820] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] OLE32.DLL!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] OLE32.DLL!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] OLE32.DLL!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe[2828] OLE32.DLL!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\mqtgsvc.exe[2840] OLE32.DLL!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] OLE32.DLL!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] OLE32.DLL!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\mqtgsvc.exe[2840] OLE32.DLL!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\svchost.exe[2880] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\svchost.exe[2880] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\svchost.exe[2880] OLE32.DLL!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\svchost.exe[2880] OLE32.DLL!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\svchost.exe[2880] OLE32.DLL!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\svchost.exe[2880] OLE32.DLL!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\Program Files\WinPortrait\floater.exe[2892] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\Program Files\WinPortrait\floater.exe[2892] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\Program Files\WinPortrait\floater.exe[2892] OLE32.DLL!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\Program Files\WinPortrait\floater.exe[2892] OLE32.DLL!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\Program Files\WinPortrait\floater.exe[2892] OLE32.DLL!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\Program Files\WinPortrait\floater.exe[2892] OLE32.DLL!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe[3028] ntdll.dll!NtCreateFile 77F7595E 5 Bytes CALL 7FFA2717 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe[3028] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe[3028] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe[3028] ntdll.dll!NtOpenFile 77F75DFB 5 Bytes CALL 7FFA2764 .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtUnloadKey 77F76696 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtUnloadKey + 4 77F7669A 2 Bytes [ 6B, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtWriteFile 77F7673B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] ntdll.dll!NtWriteFile + 4 77F7673F 2 Bytes [ 7D, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!TerminateProcess 77E616B8 6 Bytes JMP 5F310F5A .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!WriteProcessMemory 77E61A94 6 Bytes JMP 5F370F5A .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!CopyFileExW 77E7035A 6 Bytes JMP 5F3A0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!MoveFileWithProgressW 77E713A2 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!MoveFileWithProgressW + 4 77E713A6 2 Bytes [ 44, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!CreateFileMappingW 77E7A47F 6 Bytes JMP 5F3D0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!MapViewOfFileEx 77E7B641 6 Bytes JMP 5F340F5A .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!CreateRemoteThread 77E7BC9F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!CreateRemoteThread + 4 77E7BCA3 2 Bytes [ 41, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!CreateProcessInternalW 77E8033A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] kernel32.dll!CreateProcessInternalW + 4 77E8033E 2 Bytes [ 47, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!DispatchMessageW 77D43DEC 6 Bytes JMP 5FA90F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!TranslateMessage 77D43DFA 6 Bytes JMP 5F940F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!DispatchMessageA 77D44381 6 Bytes JMP 5F910F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!GetKeyState 77D46B2E 6 Bytes JMP 5FA00F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!BeginDeferWindowPos 77D47BB3 6 Bytes JMP 5F8E0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!CreateAcceleratorTableW 77D536DF 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!CreateAcceleratorTableW + 4 77D536E3 2 Bytes [ A4, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!GetAsyncKeyState 77D54E17 6 Bytes JMP 5F970F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!SetWindowsHookExA 77D55006 6 Bytes JMP 5F8B0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!SetWindowsHookExW 77D5506A 6 Bytes JMP 5FA60F5A .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!AttachThreadInput 77D58218 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!AttachThreadInput + 4 77D5821C 2 Bytes [ 9B, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!GetKeyboardState 77D61F9B 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\rundll32.exe[3296] USER32.dll!GetKeyboardState + 4 77D61F9F 2 Bytes [ 9E, 5F ] .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!CloseServiceHandle 77DD211E 6 Bytes JMP 5F100F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!OpenServiceW 77DD21F1 6 Bytes JMP 5F220F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!StartServiceA 77DDDF0E 6 Bytes JMP 5F250F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!OpenServiceA 77DE024F 6 Bytes JMP 5F1F0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!ControlService 77DE031F 6 Bytes JMP 5F130F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!StartServiceW 77DE0BC9 6 Bytes JMP 5F280F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!ChangeServiceConfigW 77DF7A75 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!ChangeServiceConfig2W 77DF7B2B 6 Bytes JMP 5F0D0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!CreateServiceW 77DF7B8A 6 Bytes JMP 5F190F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!LsaAddAccountRights 77E0FAE8 6 Bytes JMP 5F2B0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!LsaRemoveAccountRights 77E0FB66 6 Bytes JMP 5F2E0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!ChangeServiceConfigA 77E28920 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!ChangeServiceConfig2A 77E28A97 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!CreateServiceA 77E28B02 6 Bytes JMP 5F160F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ADVAPI32.dll!DeleteService 77E28C7F 6 Bytes JMP 5F1C0F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ole32.dll!CoCreateInstanceEx 771C212D 6 Bytes JMP 5F880F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ole32.dll!CoGetClassObject 771C48A9 6 Bytes JMP 5F850F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ole32.dll!CLSIDFromProgID 771EF3C3 6 Bytes JMP 5F820F5A .text C:\WINDOWS\system32\rundll32.exe[3296] ole32.dll!CLSIDFromProgIDEx 771EF7DD 6 Bytes JMP 5F7F0F5A .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!LdrLoadDll 77F55669 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!LdrLoadDll + 4 77F5566D 2 Bytes [ 4A, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtClose 77F758AA 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtClose + 4 77F758AE 2 Bytes [ 4D, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtCreateFile 77F7595E 1 Byte [ FF ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtCreateFile + 2 77F75960 1 Byte [ 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtCreateFile + 4 77F75962 2 Bytes [ 6E, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtCreateKey 77F7599A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtCreateKey + 4 77F7599E 2 Bytes [ 50, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtCreateProcess 77F759F4 5 Bytes CALL 7FFA276B .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes CALL 7FFA2778 .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDeleteFile 77F75AD5 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDeleteFile + 4 77F75AD9 2 Bytes [ 71, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDeleteKey 77F75AE4 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDeleteKey + 4 77F75AE8 2 Bytes [ 53, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDeleteValueKey 77F75B02 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDeleteValueKey + 4 77F75B06 2 Bytes [ 56, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDuplicateObject 77F75B2F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtDuplicateObject + 4 77F75B33 2 Bytes [ 59, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtEnumerateKey 77F75B5C 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtEnumerateKey + 4 77F75B60 2 Bytes [ 5C, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtEnumerateValueKey 77F75B7A 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtEnumerateValueKey + 4 77F75B7E 2 Bytes [ 5F, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtOpenFile 77F75DFB 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtOpenFile + 4 77F75DFF 2 Bytes [ 74, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtQueryMultipleValueKey 77F7609E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtQueryMultipleValueKey + 4 77F760A2 2 Bytes [ 62, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtQueryValueKey 77F7618E 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtQueryValueKey + 4 77F76192 2 Bytes [ 65, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtReadFile 77F761E8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtReadFile + 4 77F761EC 2 Bytes [ 77, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtSetInformationFile 77F7644F 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtSetInformationFile + 4 77F76453 2 Bytes [ 7A, 5F ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtSetValueKey 77F765A8 3 Bytes [ FF, 25, 1E ] .text C:\WINDOWS\system32\ctfmon.exe[3352] ntdll.dll!NtSetValueKey + 4 77F765AC 2 Bytes [ 68, 5F ]

Hi spierian,

There is an active rootkit on your machine, we will remove it using GMER:

Open GMER again, if it gives you a warning at program start about rootkit activity and asks if you want to run scan…say OK
If no warning….Check that the Rootkit tab is selected and click the Scan button - don't change any settings before you do so
Once the scan is complete, find this line:

Service C:\WINDOWS\system32\drivers\runtime2.sys (*** hidden *** ) [SYSTEM] runtime2 <– ROOTKIT !!!

Right-click the line and choose Delete the service
Then either allow GMER to reboot your system or close GMER and reboot it manually.

Then, run a new GMER scan, please do not use your computer while the scan is running, and post the log along with a new HijackThis log.

That's surprising, could you please try once more, even if GMER gives you a rootkit warning do a rootkit scan anyway.
There are two similar lines in the GMER log, please check that you are choosing the line beginning with Service, and that you are choosing the Delete the service option.

Hi, How are you getting on? If the instructions are unclear or something isn't working, please let me know before proceeding.

Hi, the instructions were fine. The problem was that the symptoms kept changing. I decided to bite the bullet and completely rebuild both PCs. I deleted and re-formatted the affected partitions, re-installed XP, SP2 and all the updates. Then I had the slog of installing all my own apps. It's now pretty much complete and despite the time and effort I am very happy with the outcome. Thanks a lot for your help. It gave me comfort to know that somebody knew how to tackle this kind of thing!

Hi spierian,

Your machine was severely infected so I can understand your decision. Here are some tips to help you keep your machine clean:

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs are set to automatically update daily.

Along with antivirus and antispyware software, you should consider installing a Personal Firewall program. Even if you are behind a NAT router, I recommend you use firewall software as it will improve the security of your computer by monitoring and controlling outbound connections to the internet as well as inbound. There are various free packages available, I recommend Sunbelt Software's Kerio or Zone Alarm:
http://www.sunbelt-software.com/Kerio
http://www.zonelabs.com/

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
If you install this, be sure to follow the DNS Client service instructions before doing so.

Spywareblaster is a free program which prevents the download and installation of Internet Explorer ActiveX based malware by immunizing your system against it. You can download Spywareblaster from here and a tutorial to help you get started is available here.

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Find out more about how to prevent infection in the future:
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know you have read this, and if there are any further issues.