ok here is the log
GMER 1.0.14.14536 -
http://www.gmer.netRootkit scan 2008-08-24 15:42:16
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwCreateKey [0xEBB077A6]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwCreateProcess [0xEBB04794]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwCreateProcessEx [0xEBB04F1E]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwDeleteKey [0xEBB081F0]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwDeleteValueKey [0xEBB0842A]
SSDT spas.sys ZwEnumerateKey [0xF8676CA2]
SSDT spas.sys ZwEnumerateValueKey [0xF8677030]
SSDT spas.sys ZwOpenKey [0xF86590C0]
SSDT spas.sys ZwQueryKey [0xF8677108]
SSDT spas.sys ZwQueryValueKey [0xF8676F88]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwRenameKey [0xEBB0912A]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwSetValueKey [0xEBB0883C]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwTerminateProcess [0xEBB03D0A]
SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwWriteVirtualMemory [0xEBB03384]
INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F7876541
INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F78765E7
INT 0x39 ? 83373BF8
INT 0x39 ? 82E15E90
INT 0x39 ? 82E15E90
INT 0x39 ? 82E15E90
INT 0x39 ? 82E15E90
INT 0x39 ? 82E15E90
INT 0x3E ? 833DEBF8
INT 0x3F ? 833DEBF8
---- Kernel code sections - GMER 1.0.14 ----
? dyzophla.sys The system cannot find the file specified. !
? spas.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload F765A62C 5 Bytes JMP 82E15470
.text asprkh2g.SYS F755C384 1 Byte [ 20 ]
.text asprkh2g.SYS F755C386 35 Bytes [ 00, 68, 00, 00, 00, 00, 00, ... ]
.text asprkh2g.SYS F755C3AA 24 Bytes [ 00, 00, 20, 00, 00, E0, 00, ... ]
.text asprkh2g.SYS F755C3C4 3 Bytes [ 00, 00, 00 ]
.text asprkh2g.SYS F755C3C9 1 Byte [ 00 ]
.text ...
? system32\DRIVERS\avgfwdx.sys The system cannot find the file specified. !
? System32\Drivers\avgmfx86.sys The system cannot find the file specified. !
? System32\Drivers\avgldx86.sys The system cannot find the file specified. !
? System32\Drivers\avgtdix.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\mchInjDrv.sys The system cannot find the file specified. !
.text ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
---- User code sections - GMER 1.0.14 ----
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, F1, 83 ]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[332] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, B8, 87 ]
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[500] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\svchost.exe[764] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\WINDOWS\system32\svchost.exe[764] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, ED, 83 ]
.text C:\WINDOWS\system32\svchost.exe[764] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\WINDOWS\system32\svchost.exe[764] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\msiexec.exe[848] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\WINDOWS\system32\msiexec.exe[848] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, 04, 84 ]
.text C:\WINDOWS\system32\msiexec.exe[848] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, EF, F4 ]
.text C:\WINDOWS\system32\msiexec.exe[848] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\WINDOWS\system32\msiexec.exe[848] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\Explorer.EXE[960] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\WINDOWS\Explorer.EXE[960] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, A2, 85 ]
.text C:\WINDOWS\Explorer.EXE[960] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\WINDOWS\Explorer.EXE[960] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, BA, 83 ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, EF, F4 ]
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\Documents and Settings\Alim\Desktop\gmer\gmer.exe[1056] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, 7E, 84 ]
.text C:\WINDOWS\system32\spoolsv.exe[1076] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\WINDOWS\system32\spoolsv.exe[1076] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\csrss.exe[1128] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\WINDOWS\system32\csrss.exe[1128] KERNEL32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, D5, 84 ]
.text C:\WINDOWS\system32\csrss.exe[1128] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\WINDOWS\system32\csrss.exe[1128] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\winlogon.exe[1164] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[1164] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, D7, 84 ]
.text C:\WINDOWS\system32\winlogon.exe[1164] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\WINDOWS\system32\winlogon.exe[1164] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtClose + 4 7C90D58A 2 Bytes [ 2C, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtCreateFile 7C90D682 1 Byte [ FF ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtCreateFile + 2 7C90D684 1 Byte [ 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtCreateFile + 4 7C90D686 2 Bytes [ 17, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtCreateKey 7C90D6D6 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtCreateKey + 4 7C90D6DA 2 Bytes [ 05, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtCreateSection 7C90D793 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtCreateSection + 4 7C90D797 2 Bytes [ 23, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtDeleteKey 7C90D8A4 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtDeleteKey + 4 7C90D8A8 2 Bytes [ 0B, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtRenameKey 7C90E339 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtRenameKey + 4 7C90E33D 2 Bytes [ 14, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtSetInformationFile 7C90E5D9 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtSetInformationFile + 4 7C90E5DD 2 Bytes [ 20, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtSetValueKey + 4 7C90E7C0 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 26, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtWriteFile 7C90E9F3 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtWriteFile + 4 7C90E9F7 2 Bytes [ 1A, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtWriteFileGather 7C90EA08 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtWriteFileGather + 4 7C90EA0C 2 Bytes [ 1D, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtWriteVirtualMemory 7C90EA32 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\system32\services.exe[1212] ntdll.dll!NtWriteVirtualMemory + 4 7C90EA36 2 Bytes [ 29, 5F ]
.text C:\WINDOWS\system32\services.exe[1212] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes [ 47, E4, FB, 83 ]
.text C:\WINDOWS\system32\services.exe[1212] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F320F5A
.text C:\WINDOWS\system32\services.exe[1212] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\system32\lsass.exe[1224] ntdll.dll!NtClose 7C90D586 3 Bytes [ FF, 25, 1E ]
.text C:\WIND