Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Well hidden problem, a real challenge

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Well hidden problem, a real challenge

Unread postby -JR- » November 5th, 2006, 9:58 pm

I'm a 8.5/10 computer user and I'm stuck. Caught a worm from a infected website a couple weeks ago and have been cleaning out my PC ever since. I think I've got everything cleaned out now but for one problem I can not find the root of.

I have packet captures of my PC performing a mail bomb on several popular servers that the unwanted process downloads from a site located at 64.62.171.200 As a work around for now I have entered a static route to no where in my PC for this network.

Image

I can post the packet capture logs as well if it might be of help.

I believe the unwanted process has embedded it's self into a windows service or perhaps the kernel it's self. I suspect this because I've used the KILL utility to kill off all processes in the task manager (except the taskman.exe) but the problem still persists.

*The fault doesn't happen in Safe Mode with Networking, but does under a normal boot. So I'm posting HiJackThis logs for both conditions.

SPyBot Search & Destroy doesn't find it
HiJackThis Doesn't find it
AVG Anti Virus doesn't find it
AVG Anit Spyware doesn't find it
Microsoft's Anti malware doesn't find it
Microsoft's Anti Spyware doesn't find it
EEYE's Retina scanner doens't find it
Running the SFC.EXE tool didn'f fix it

I don't know where else to turn so I came here.

Hijackthis normal boot
-----------------------------------------
Logfile of HijackThis v1.97.7
Scan saved at 5:16:17 PM, on 11/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\Retina\Scanner\RetinaEngine.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\D-Tools\daemon.exe
D:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
d:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdat ... /opuc3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 0889904937

****end****

Hijackthis Safe mode with networking
----------------------------
Logfile of HijackThis v1.97.7
Scan saved at 4:57:31 PM, on 11/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdat ... /opuc3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 0889904937


*****end******
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm
Advertisement
Register to Remove

Unread postby -JR- » November 5th, 2006, 10:15 pm

Also to note...

My uploading network preformance has gone into the ditch since this has all happend.

I frequently get NDIS.SYS blue screens when I am downloading now. Occasionally I will also get a Service.exe application failure message on boot up with the status code of 1073741819. This sends the computer into a forced shutdown.

I have replaced the NDIS.SYS with a version from my XP SP2 cd and Services.exe only seems to be tied to the Event Log and to Plug And Play services. Neither of which are a required opperating process as far as I know, but I might be wrong. Both of these processes ARE running when I do get the Services.exe error message.
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm

Unread postby Kimberly » November 6th, 2006, 1:47 am

Hello -JR-,

That sounds like a possible rootkit. I would need a couple of logs in order to gather information.

When you get the NDIS.SYS blue screen ... are you able to see the stop error ?

You remember the name of the worm you caught ?

First, your hijackthis is a bit outdated, latest version is now 1.99
Please download the most recent version, it will also show more important sections. Run all scans from Normal Mode please.

Download HijackThis to your Desktop or to your usual Download Folder.
http://www.thespykiller.co.uk/files/HJTSetup.exe

Double click on HJTSetup.exe and by default it should install to C:\Program Files\Hijack This
Continue through the setup and let it create a Desktop Icon.
Follow all the prompts, click Finish, and let the installer start HijackThis.
Run HijackThis, click on Open the Misc Tools Section, put a checkmark in List also minor sections and List empty sections. Click on Generate StartupList log, anwser Yes and copy/paste the content in your reply.
Click Back and Click on Scan. When the scan is finished, click Save Log and paste the content in your reply.
______________________________

Make sure that you can see hidden files.
  1. Click Start.
  2. Click My Computer.
  3. Select the Tools menu and click Folder Options.
  4. Select the View Tab.
  5. Under the Hidden files and folders heading select Show hidden files and folders.
  6. Uncheck the Hide protected operating system files (recommended) option.
  7. Click Yes to confirm.
  8. Uncheck the Hide file extensions for known file types.
  9. Click OK.
______________________________

Using Windows explorer, see if you find c:\windows\ntbtlog.txt - If it exists, delete the file.
  1. Click Start then Run and type in msconfig in the edit box and hit Enter or click Ok
  2. Click on the boot.ini tab and check the box that says /BOOTLOG
  3. Click Apply & Ok and reboot the PC (may take a bit longer to boot)
  4. Using Windows Explorer, locate c:\windows\ntbtlog.txt and post the content of the file.
Once the log posted, you may uncheck the /bootlog option again in msconfig
______________________________

Download Gmer to your Desktop and unzip it to your Desktop.
http://www.gmer.net/gmer.zip

Disconnect from internet and close running programs.
There is a small chance this application may crash your computer so save any work you have open.
Double click gmer.exe.
Let the gmer.sys driver load if asked.
If it gives you a warning at program start about rootkit activity and asks if you want to run scan...say Ok.
If no warning....
Click the rootkit tab
To the right of the program you will see a bunch of boxes that have been checked... leave everything checked. Then click the Scan button. Wait for the scan to finish.
Once done click the Copy button.
Open Notepad and hit ctrl+v to paste the log. Save the log to your desktop please.

Click the >>> tab. This will open up all available tabs for you.
Click the Autostart tab then the scan button. Once its done click the Copy button and paste it into a new notepad document. Save that document to your desktop please.

Post the 2 gmer logs, ntbtlog.txt, the hijackthis startuplist, hijackthis log please.
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby -JR- » November 6th, 2006, 4:18 am

Thanks Kim!

It's past midnight here now and have to be at work in a few hours. So I'll do those things and post the results tomorrow.

Thanks again!
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm

Unread postby Kimberly » November 6th, 2006, 12:18 pm

Ok, thanks for letting me know -JR- :)
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby -JR- » November 7th, 2006, 1:16 am

Ok, apparently ther site has an issue with me making a post that is like 3MB in PLAIN TEXT! Go figure...

So I will try and make a couple posts with the details.
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm

Unread postby -JR- » November 7th, 2006, 1:19 am

Ok Kimberly... more info then you ever wanted!!!

*First off I nailed the problem... I have been infected by a variant on the Backdoor.Rustock.B or Spam-Mailbot.C So far I removed the hidden service that was C:\WINDOWS\SYSTEM32:LZX32.SYS

As of yet I need to research and find out how to effectivly clean it out. However I am not certain that I have isolated all the problems yet. I will do some testing to know for sure.

Here is a list of the known malware I was infected with from this event...
Proxy.Small.Bo
Proxy.Agent.lb
Proxy.HJR
Adware.Sahat
Adware.Winad
Adware.WebSearch
Adware.Sidestep
Adware.ISTBAR
Adware.PSGUARD
Backdoor.SDBOT
Downloader.Agent.BC
Downloader.Harnig.AN
Downloader.Delf.lh
Downloader.Delf.wp
Downloader.Small.ctd
Downloader.Small.ctf
Downloader.Tibs
Downloader.wintool.f
Downloader.Zlob.af
Hijacker.Agent.cr
Hijacker.Agent.dj
Logger.Goldun.lv
Logger.Goldun.lk
Logger.Goldun.mc
Trojan.Agent.eq
Trojan.Agent.ff
Trojan.Dialer.lw
Trojan.Favadd.aj
**pant pant pant**
Trojan.ProcKill.DJ
Trojan.Puper.be
Trojan.Puper.bf
Trojan.Sinowal.az
Trojan.Small.ev
Trojan.Zapchast
Worm.Kelvir.al
Worm.VB.CC
Worm.AlcanA
Win32/Nsag

All of these were dumped into my machine on that attack and took A LONG TIME TO TYPE! It's a good thing you have a sexy looking AVATAR :-)

GMER Report...




GMER 1.0.12.11879 - http://www.gmer.net
Rootkit scan 2006-11-06 20:43:46
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT d346bus.sys ZwClose
SSDT d346bus.sys ZwCreateKey
SSDT d346bus.sys ZwCreatePagingFile
SSDT d346bus.sys ZwEnumerateKey
SSDT d346bus.sys ZwEnumerateValueKey
SSDT d346bus.sys ZwOpenFile
SSDT d346bus.sys ZwOpenKey
SSDT d346bus.sys ZwQueryKey
SSDT d346bus.sys ZwQueryValueKey
SSDT d346bus.sys ZwSetSystemPowerState

---- Kernel code sections - GMER 1.0.12 ----

.text ntoskrnl.exe!ZwYieldExecution + 218 804E4914 2 Bytes

---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NlsMbOemCodePageTag + -503832 7C901000 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnterCriticalSection + 45 7C901032 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnterCriticalSection + 88 7C90105D 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnterCriticalSection + 109 7C901072 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnterCriticalSection + 126 7C901083 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnterCriticalSection + 132 7C901089 20 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLeaveCriticalSection + 29 7C90110A 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLeaveCriticalSection + 51 7C901120 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlTryEnterCriticalSection + 8 7C901133 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlTryEnterCriticalSection + 35 7C90114E 115 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlActivateActivationContextUnsafeFast + 13 7C9011C2 79 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDeactivateActivationContextUnsafeFast + 24 7C901212 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCurrentTeb + 6 7C901256 51 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitString + 46 7C90128A 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitAnsiString + 25 7C9012B2 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitAnsiString + 51 7C9012CC 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitUnicodeString + 13 7C9012E3 76 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!cos + 5 7C901330 145 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!cos + 151 7C9013C2 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIlog + 16 7C9013E3 86 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIlog + 103 7C90143A 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIlog + 105 7C90143C 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIlog + 129 7C901454 142 Bytes JMP 7C870476 C:\WINDOWS\system32\kernel32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIpow + 44 7C9014E3 11 Bytes JMP 083607EA
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIpow + 56 7C9014EF 126 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIpow + 183 7C90156E 227 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIpow + 411 7C901652 68 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIpow + 481 7C901698 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIsin + 11 7C9016D6 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_CIsin + 16 7C9016DB 231 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!sqrt + 49 7C9017C3 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!sqrt + 104 7C9017FA 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!sqrt + 153 7C90182B 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alldiv + 25 7C901856 185 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alldvrm + 37 7C901911 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alldvrm + 73 7C901935 63 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alldvrm + 137 7C901975 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alldvrm + 151 7C901983 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alldvrm + 202 7C9019B6 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_allmul + 25 7C9019E9 62 Bytes JMP 7C901CC5 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alloca_probe + 31 7C901A28 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alloca_probe + 44 7C901A35 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alloca_probe + 53 7C901A3E 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_alloca_probe + 64 7C901A49 223 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_allshr + 3 7C901B29 79 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_aulldiv + 45 7C901B79 90 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_aulldvrm + 27 7C901BD4 81 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_aulldvrm + 109 7C901C26 234 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_ftol + 32 7C901D11 72 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_memccpy + 61 7C901D5A 85 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!atan + 59 7C901DB0 91 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!atan + 151 7C901E0C 126 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!ceil + 109 7C901E8B 239 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!floor + 30 7C901F7B 20 Bytes JMP 7C901EB9 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!floor + 51 7C901F90 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!floor + 67 7C901FA0 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!floor + 72 7C901FA5 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!floor + 85 7C901FB2 190 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memcmp + 92 7C9021AB 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memcmp + 128 7C9021CF 72 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memcpy + 24 7C902218 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memcpy + 37 7C902225 147 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memcpy + 185 7C9022B9 63 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memcpy + 249 7C9022F9 78 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memcpy + 328 7C902348 80 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memmove + 80 7C90258A 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memmove + 85 7C90258F 63 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memmove + 149 7C9025CF 109 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memmove + 259 7C90263D 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memmove + 269 7C902647 37 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!memset + 78 7C9028C8 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcat + 1 7C9028ED 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcat + 12 7C9028F8 110 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcat + 124 7C902968 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcat + 144 7C90297C 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcat + 161 7C90298D 9 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcspn + 33 7C902A7C 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcspn + 35 7C902A7E 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strcspn + 37 7C902A80 120 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strlen + 92 7C902AF9 51 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strncat + 18 7C902B2D 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strncat + 46 7C902B49 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strncat + 61 7C902B58 17 Bytes JMP 7C902E52 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strncat + 79 7C902B6A 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strncat + 117 7C902B90 133 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strncpy + 174 7C902D2E 376 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!tan + 105 7C902EA7 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!tan + 173 7C902EEB 148 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFirstEntrySList 7C902F82 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFirstEntrySList + 31 7C902FA1 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFirstEntrySList + 39 7C902FA9 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUlongByteSwap + 1 7C902FCA 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUlonglongByteSwap + 13 7C902FEB 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCompareMemory + 5 7C902FFB 85 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCompareMemoryUlong + 6 7C903051 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCompareMemoryUlong + 39 7C903072 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFillMemory + 16 7C903090 38 Bytes JMP 08362397
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFillMemory + 56 7C9030B8 251 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMoveMemory + 100 7C9031B5 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMoveMemory + 116 7C9031C5 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMoveMemory + 145 7C9031E2 86 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMoveMemory + 232 7C903239 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMoveMemory + 270 7C90325F 115 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnlargedUnsignedMultiply + 11 7C9034FA 14 Bytes JMP 7C903634 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnlargedUnsignedDivide + 9 7C903509 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEnlargedUnsignedDivide + 35 7C903523 94 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlExtendedLargeIntegerDivide + 93 7C903582 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlExtendedMagicDivide + 21 7C90359C 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlExtendedMagicDivide + 67 7C9035CA 144 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlExtendedIntegerMultiply + 62 7C90365B 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlExtendedIntegerMultiply + 81 7C90366E 51 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLargeIntegerShiftLeft + 39 7C9036A2 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLargeIntegerArithmeticShift + 10 7C9036DF 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLargeIntegerArithmeticShift + 44 7C903701 5 Bytes JMP 7C903A05 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLargeIntegerNegate + 1 7C903707 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLargeIntegerSubtract + 1 7C903720 82 Bytes JMP 7C903AE7 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlConvertUlongToLargeInteger + 46 7C903773 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlConvertUlongToLargeInteger + 54 7C90377B 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlConvertUlongToLargeInteger + 62 7C903783 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlConvertUlongToLargeInteger + 79 7C903794 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlConvertUlongToLargeInteger + 89 7C90379E 38 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCaptureContext + 24 7C90385D 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCaptureContext + 37 7C90386A 18 Bytes JMP 7C903DE2 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCaptureContext + 56 7C90387D 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCaptureContext + 69 7C90388A 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCaptureContext + 74 7C90388F 8 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAcceptConnectPort + 3 7C90D37C 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAccessCheck 7C90D38E 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAccessCheck + 15 7C90D39D 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAccessCheckByType + 5 7C90D3BD 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAccessCheckByTypeAndAuditAlarm + 3 7C90D3D0 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAccessCheckByTypeResultList + 3 7C90D3E5 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm 7C90D3F7 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle + 7 7C90D413 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAddAtom + 7 7C90D428 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAddBootEntry + 7 7C90D43D 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAlertResumeThread + 7 7C90D47C 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAllocateUserPhysicalPages + 5 7C90D4B9 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAllocateUserPhysicalPages + 7 7C90D4BB 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAllocateUuids + 15 7C90D4D8 20 Bytes JMP 7C90D67D C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAllocateVirtualMemory + 15 7C90D4ED 10 Bytes JMP 7C90D680 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAreMappedFilesTheSame + 5 7C90D4F8 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtAssignProcessToJobObject + 15 7C90D517 96 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtClearEvent + 7 7C90D578 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCompactKeys + 5 7C90D5B5 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCompactKeys + 11 7C90D5BB 87 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtConnectPort + 15 7C90D613 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateDirectoryObject + 15 7C90D652 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateFile + 5 7C90D687 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateIoCompletion + 7 7C90D69E 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateJobObject + 11 7C90D6B7 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateJobSet + 15 7C90D6D0 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateKey + 13 7C90D6E3 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateKey + 20 7C90D6EA 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateMailslotFile + 8 7C90D6F3 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateMutant 7C90D700 69 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreatePort + 7 7C90D746 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateProcess + 8 7C90D75C 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateProfile + 19 7C90D791 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateSymbolicLinkObject + 15 7C90D7CC 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateThread 7C90D7D2 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateTimer + 15 7C90D7F6 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateWaitablePort 7C90D811 59 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtDelayExecution 7C90D850 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtDeleteAtom + 12 7C90D871 103 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtDeleteValueKey + 11 7C90D8D9 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtDeviceIoControlFile + 7 7C90D8EA 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtDisplayString + 19 7C90D90B 77 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtEnumerateKey + 13 7C90D959 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtEnumerateKey + 15 7C90D95B 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtEnumerateValueKey 7C90D976 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtFilterToken + 11 7C90D9AB 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtFindAtom + 11 7C90D9C0 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtFlushBuffersFile + 3 7C90D9CD 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtFlushKey + 11 7C90D9FF 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtFlushVirtualMemory 7C90DA09 86 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtFsControlFile + 3 7C90DA60 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtFsControlFile + 15 7C90DA6C 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtGetDevicePowerState + 5 7C90DA8C 47 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtGetWriteWatch + 11 7C90DABC 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtImpersonateAnonymousToken 7C90DAC6 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtImpersonateAnonymousToken + 13 7C90DAD3 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtImpersonateThread + 5 7C90DAF5 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtImpersonateThread + 7 7C90DAF7 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtImpersonateThread + 13 7C90DAFD 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtImpersonateThread + 20 7C90DB04 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtInitiatePowerAction 7C90DB1A 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtIsProcessInJob + 3 7C90DB32 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtIsProcessInJob + 11 7C90DB3A 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtListenPort 7C90DB59 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtListenPort + 15 7C90DB68 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLoadKey 7C90DB83 46 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLockFile + 5 7C90DBB2 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLockFile + 8 7C90DBB5 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLockFile + 17 7C90DBBE 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLockProductActivationKeys + 13 7C90DBCF 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLockProductActivationKeys + 20 7C90DBD6 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLockRegistryKey + 18 7C90DBE9 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtLockVirtualMemory + 11 7C90DBF7 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtMakePermanentObject + 4 7C90DC05 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtMapUserPhysicalPages + 13 7C90DC38 109 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtNotifyChangeMultipleKeys 7C90DCA9 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenDirectoryObject + 12 7C90DCCA 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenEventPair + 11 7C90DCF3 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenIoCompletion + 19 7C90DD25 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenJobObject + 7 7C90DD2E 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenJobObject + 19 7C90DD3A 152 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenSemaphore + 4 7C90DDD3 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenSymbolicLinkObject + 9 7C90DDED 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenThread + 4 7C90DDFD 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenTimer 7C90DE38 79 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtPrivilegeCheck + 17 7C90DE88 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtPrivilegeObjectAuditAlarm + 5 7C90DE91 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtPrivilegeObjectAuditAlarm + 7 7C90DE93 91 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryAttributesFile + 15 7C90DEEF 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryDebugFilterState + 3 7C90DF22 64 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryDirectoryFile + 5 7C90DF63 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryEaFile + 4 7C90DF8C 86 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryInformationFile + 7 7C90DFE3 66 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryInformationProcess + 11 7C90E026 110 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryKey 7C90E099 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryKey + 15 7C90E0A8 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryMutant 7C90E0C3 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryObject + 4 7C90E0DC 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryOpenSubKeys + 7 7C90E0F4 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryOpenSubKeys + 15 7C90E0FC 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryPerformanceCounter + 7 7C90E109 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryPerformanceCounter + 13 7C90E10F 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryPerformanceCounter + 15 7C90E111 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQueryQuotaInformationFile + 20 7C90E12B 87 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQuerySystemEnvironmentValue + 4 7C90E184 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQuerySystemEnvironmentValueEx + 15 7C90E1A4 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQuerySystemInformation + 15 7C90E1B9 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtQuerySystemTime + 7 7C90E1C6 180 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtReadFile 7C90E27C 77 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtReadVirtualMemory + 15 7C90E2CA 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtReleaseMutant + 5 7C90E2EA 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtRemoveIoCompletion + 4 7C90E313 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtRemoveIoCompletion + 15 7C90E31E 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtReplaceKey + 13 7C90E35B 126 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtRequestPort + 14 7C90E3DA 76 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtResetWriteWatch + 7 7C90E427 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtResetWriteWatch + 14 7C90E42E 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtRestoreKey + 5 7C90E43A 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtRestoreKey + 7 7C90E43C 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtResumeProcess + 3 7C90E44D 21 Bytes JMP 7C90E552 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtResumeThread + 4 7C90E463 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtResumeThread + 7 7C90E466 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSaveKey + 3 7C90E477 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSaveKeyEx + 4 7C90E48D 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSaveMergedKeys + 5 7C90E4A3 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSecureConnectPort + 7 7C90E4BA 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetContextThread + 7 7C90E4F9 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetDebugFilterState + 4 7C90E50B 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetDefaultUILanguage + 5 7C90E54B 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetEaFile + 14 7C90E569 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetEvent + 7 7C90E577 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetEventBoostPriority + 5 7C90E58A 127 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetInformationKey + 7 7C90E60A 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetInformationObject + 11 7C90E623 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetInformationObject + 17 7C90E629 346 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetTimer + 7 7C90E784 79 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtSetVolumeInformationFile + 3 7C90E7D4 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtShutdownSystem + 18 7C90E7F8 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtStartProfile + 4 7C90E814 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtStartProfile + 7 7C90E817 201 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtTranslateFilePath 7C90E8E2 154 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtVdmControl + 8 7C90E97D 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtWaitForMultipleObjects 7C90E99F 87 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtWriteFile + 5 7C90E9F8 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtWriteFile + 15 7C90EA02 104 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtCreateKeyedEvent + 15 7C90EA6B 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtOpenKeyedEvent 7C90EA71 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!NtWaitForKeyedEvent + 4 7C90EA9F 230 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!KiRaiseUserExceptionDispatcher + 73 7C90EB86 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!KiIntSystemCall + 4 7C90EBA9 121 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlRaiseException + 119 7C90EC23 63 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlRaiseException + 184 7C90EC64 132 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strstr + 122 7C90ECE9 205 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strchr + 182 7C90EDB7 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strchr + 197 7C90EDC6 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strchr + 206 7C90EDCF 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strchr + 230 7C90EDE7 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!strchr + 251 7C90EDFC 80 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAnsiStringToUnicodeString + 95 7C90F0AB 91 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAnsiStringToUnicodeString + 188 7C90F108 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAnsiStringToUnicodeString + 245 7C90F141 55 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAnsiStringToUnicodeString + 301 7C90F179 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAnsiStringToUnicodeString + 336 7C90F19C 83 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMultiByteToUnicodeN + 37 7C90F1F0 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMultiByteToUnicodeN + 51 7C90F1FE 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMultiByteToUnicodeN + 79 7C90F21A 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMultiByteToUnicodeN + 88 7C90F223 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlMultiByteToUnicodeN + 106 7C90F235 105 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlNtStatusToDosError + 29 7C90FB5A 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlNtStatusToDosError + 42 7C90FB67 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 6 7C90FB8F 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 47 7C90FBB8 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 52 7C90FBBD 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 73 7C90FBD2 181 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 255 7C90FC88 61 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAddRefActivationContext + 4 7C9100E6 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAddRefActivationContext + 16 7C9100F2 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAddRefActivationContext + 54 7C910118 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAddRefActivationContext + 117 7C910157 77 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAddRefActivationContext + 195 7C9101A5 31 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlQueryInformationActivationContext + 44 7C91020E 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlQueryInformationActivationContext + 59 7C91021D 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlQueryInformationActivationContext + 71 7C910229 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlQueryInformationActivationContext + 115 7C910255 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlQueryInformationActivationContext + 145 7C910273 4 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlRestoreLastWin32Error + 2 7C910342 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcslen + 34 7C91037C 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcslen + 57 7C910393 271 Bytes JMP 7C91052E C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFreeHeap + 102 7C9104A3 89 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFreeHeap + 193 7C9104FE 229 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAllocateHeap + 18 7C9105E6 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAllocateHeap + 54 7C91060A 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAllocateHeap + 85 7C910629 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAllocateHeap + 154 7C91066E 68 Bytes JMP 7C9107A2 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAllocateHeap + 223 7C9106B3 85 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageDirectoryEntryToData + 68 7C91089A 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageDirectoryEntryToData + 94 7C9108B4 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageDirectoryEntryToData + 128 7C9108D6 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUpcaseUnicodeChar + 25 7C910909 91 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlReleasePebLock + 5 7C910966 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlFreeAnsiString + 1 7C910977 134 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlSizeHeap + 18 7C9109FF 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlSizeHeap + 27 7C910A08 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlSizeHeap + 70 7C910A33 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlSizeHeap + 94 7C910A4B 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlReleaseActivationContext + 45 7C910A84 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcsncpy + 48 7C910ABF 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcsncpy + 98 7C910AF1 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcsncpy + 141 7C910B1C 73 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcsncpy + 215 7C910B66 72 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcsncpy + 288 7C910BAF 11 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDeleteCriticalSection + 50 7C9118BC 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDeleteCriticalSection + 109 7C9118F7 80 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDeleteCriticalSection + 190 7C911948 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDeleteCriticalSection + 199 7C911951 198 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDeleteCriticalSection + 398 7C911A18 46 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSectionAndSpinCount + 29 7C911A47 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSectionAndSpinCount + 74 7C911A74 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSectionAndSpinCount + 79 7C911A79 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSectionAndSpinCount + 141 7C911AB7 47 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlLogStackBackTrace + 5 7C911AE9 116 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSection + 49 7C911B5E 55 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSection + 105 7C911B96 59 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSection + 165 7C911BD2 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSection + 196 7C911BF1 184 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlInitializeCriticalSection + 381 7C911CAA 182 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlTimeToTimeFields + 39 7C912434 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlTimeToTimeFields + 59 7C912448 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlTimeToTimeFields + 85 7C912462 298 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlTimeToTimeFields + 384 7C91258D 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlTimeToTimeFields + 387 7C912590 32 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrAccessResource + 34 7C912CC4 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrLoadAlternateResourceModule + 5 7C912CDA 77 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrLoadAlternateResourceModule + 83 7C912D28 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrAlternateResourcesEnabled + 8 7C912D5D 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrAlternateResourcesEnabled + 14 7C912D63 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrAlternateResourcesEnabled + 19 7C912D68 61 Bytes JMP 7C912E75 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrAlternateResourcesEnabled + 82 7C912DA7 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAddressInSectionTable + 18 7C912DC4 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlAddressInSectionTable + 41 7C912DDB 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageRvaToSection + 37 7C912E09 78 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageRvaToSection + 116 7C912E58 84 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageRvaToSection + 201 7C912EAD 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageRvaToSection + 240 7C912ED4 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlImageRvaToSection + 276 7C912EF8 29 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeToMultiByteN + 4 7C912F9F 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeToMultiByteN + 36 7C912FBF 164 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeToMultiByteN + 201 7C913064 116 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeStringToAnsiString + 19 7C9130D9 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeStringToAnsiString + 40 7C9130EE 89 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeStringToAnsiString + 130 7C913148 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeStringToAnsiString + 143 7C913155 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeStringToAnsiString + 159 7C913165 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrLockLoaderLock + 39 7C913198 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrLockLoaderLock + 55 7C9131A8 79 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrLockLoaderLock + 135 7C9131F8 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrLockLoaderLock + 138 7C9131FB 99 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!LdrUnlockLoaderLock + 54 7C91325F 69 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!CsrClientCallServer + 4 7C9132A5 99 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!CsrClientCallServer + 105 7C91330A 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!CsrClientCallServer + 111 7C913310 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!CsrClientCallServer + 142 7C91332F 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!CsrClientCallServer + 163 7C913344 29 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_strcmpi + 12 7C913380 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_strcmpi + 18 7C913386 33 Bytes JMP 065B36AA
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!_strcmpi + 52 7C9133A8 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEqualUnicodeString + 1 7C9133CF 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEqualUnicodeString + 33 7C9133EF 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlEqualUnicodeString + 48 7C9133FE 117 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!wcscpy + 1 7C913474 100 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlValidSid + 67 7C9134DA 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlValidSid + 102 7C9134FD 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlValidSid + 146 7C913529 107 Bytes JMP 7C9136D7 C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCreateUnicodeStringFromAsciiz + 4 7C913595 89 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsDosDeviceName_U + 47 7C9135EF 32 Bytes JMP 7C9139CC C:\WINDOWS\system32\ntdll.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsDosDeviceName_U + 81 7C913611 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsDosDeviceName_U + 88 7C913618 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsDosDeviceName_U + 90 7C91361A 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsDosDeviceName_U + 117 7C913635 7 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCopyLuid + 16 7C913674 59 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCopySid + 46 7C9136B0 64 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeToMultiByteSize + 32 7C9136F2 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnicodeToMultiByteSize + 36 7C9136F6 151 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnlockHeap + 3 7C91378E 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnlockHeap + 21 7C9137A0 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnlockHeap + 79 7C9137DA 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlUnlockHeap + 85 7C9137E0 46 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsValidHandle + 26 7C91380F 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsValidHandle + 37 7C91381A 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlIsValidHandle + 93 7C913852 280 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlCreateUnicodeString + 33 7C91396B 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDetermineDosPathNameType_U + 1 7C9139A0 196 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDetermineDosPathNameType_U + 199 7C913A66 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDetermineDosPathNameType_U + 267 7C913AAA 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDetermineDosPathNameType_U + 307 7C913AD2 292 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDetermineDosPathNameType_U + 600 7C913BF7 28 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDosPathNameToNtPathName_U + 23 7C914114 109 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlDosPathNameToNtPathName_U + 133 7C914182 64 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlGetFullPathName_U + 18 7C9141C3 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlGetFullPathName_U + 76 7C9141FD 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlGetFullPathName_U + 85 7C914206 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdll.dll!RtlPrefixUnicodeString + 2 7C914212 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ntdl
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm

Unread postby -JR- » November 7th, 2006, 1:20 am

.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!DecryptFileW + 35 77E12FDA 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!DecryptFileW + 61 77E12FF4 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FileEncryptionStatusW + 1 77E12FFB 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FileEncryptionStatusW + 4 77E12FFE 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!OpenEncryptedFileRawW 77E13026 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!OpenEncryptedFileRawW + 4 77E1302A 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ReadEncryptedFileRaw 77E13058 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CloseEncryptedFileRaw 77E13084 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CloseEncryptedFileRaw + 11 77E1308F 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CloseEncryptedFileRaw + 13 77E13091 66 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FreeEncryptionCertificateHashList 77E130D5 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FreeEncryptionCertificateHashList + 4 77E130D9 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!QueryRecoveryAgentsOnEncryptedFile + 27 77E13110 85 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!RemoveUsersFromEncryptedFile + 54 77E13166 109 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!DuplicateEncryptionInfoFile + 2 77E131D4 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!DuplicateEncryptionInfoFile + 53 77E13207 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!EncryptionDisable + 22 77E13223 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!EncryptedFileKeyInfo + 22 77E1324F 122 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!EncryptFileA + 54 77E132CA 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!EncryptFileA + 56 77E132CC 134 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!DecryptFileA + 43 77E13354 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!DecryptFileA + 51 77E1335C 78 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!DecryptFileA + 130 77E133AB 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FileEncryptionStatusA + 11 77E133CC 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FileEncryptionStatusA + 51 77E133F4 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FileEncryptionStatusA + 64 77E13401 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FileEncryptionStatusA + 132 77E13445 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!FileEncryptionStatusA + 146 77E13453 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!OpenEncryptedFileRawA + 2 77E1345E 59 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!OpenEncryptedFileRawA + 62 77E1349A 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!OpenEncryptedFileRawA + 68 77E134A0 65 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!OpenEncryptedFileRawA + 134 77E134E2 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!OpenEncryptedFileRawA + 195 77E1351F 123 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDRootDomainW + 13 77E14518 225 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDDomainW + 68 77E145FA 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDDomainW + 80 77E14606 128 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorW + 91 77E14688 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorW + 104 77E14695 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorW + 106 77E14697 71 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDRootDomainA + 28 77E146E0 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDRootDomainA + 61 77E14701 66 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + 2 77E14744 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + 19 77E14755 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + 36 77E14766 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + 72 77E1478A 47 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + 120 77E147BA 41 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDDomainA + 1 77E14821 68 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDDomainA + 70 77E14866 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSDToSDDomainA + 104 77E14888 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSidToSidA + 2 77E148C6 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSidToSidA + 12 77E148D0 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSidToSidA + 45 77E148F1 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSidToSidA + 87 77E1491B 47 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + 18 77E1494B 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + 47 77E14968 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + 56 77E14971 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + 107 77E149A4 66 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 51 77E149E7 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 57 77E149ED 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 79 77E14A03 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 83 77E14A07 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 116 77E14A28 11 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword + 27 77E14FEE 86 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword + 114 77E15045 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword + 119 77E1504A 66 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword + 186 77E1508D 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword + 190 77E15091 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword2 + 31 77E15323 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword2 + 40 77E1532C 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword2 + 49 77E15335 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword2 + 100 77E15368 66 Bytes JMP 77E158EA C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!MSChapSrvChangePassword2 + 167 77E153AB 195 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateProcessWithLogonW + 104 77E15D05 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateProcessWithLogonW + 112 77E15D0D 87 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateProcessWithLogonW + 200 77E15D65 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateProcessWithLogonW + 224 77E15D7D 290 Bytes JMP 77E15EFF C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateProcessWithLogonW + 515 77E15EA0 88 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ProcessIdleTasks 77E16CC9 88 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ProcessIdleTasks + 89 77E16D22 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ProcessIdleTasks + 115 77E16D3C 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!ProcessIdleTasks + 127 77E16D48 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UnregisterIdleTask + 9 77E16D62 113 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UnregisterIdleTask + 124 77E16DD5 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UnregisterIdleTask + 126 77E16DD7 165 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction013 + 2 77E16E7D 100 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction016 + 32 77E16EE2 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction016 + 45 77E16EEF 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction016 + 47 77E16EF1 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction016 + 49 77E16EF3 133 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction024 + 50 77E16F7A 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction026 + 3 77E16FA3 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction014 + 4 77E16FB1 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction032 + 23 77E16FD4 69 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction032 + 93 77E1701A 12 Bytes JMP 41A07F2F
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction032 + 107 77E17028 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction032 + 109 77E1702A 83 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SystemFunction032 + 193 77E1707E 143 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpEncodeCredential + 99 77E1710E 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpDecodeCredential + 54 77E17149 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpDecodeCredential + 98 77E17175 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpDecodeCredential + 161 77E171B4 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpDecodeCredential + 192 77E171D3 96 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpDecodeCredential + 289 77E17234 26 Bytes JMP 77E1710F C:\WINDOWS\system32\ADVAPI32.dll
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpConvertCredential + 126 77E1765E 104 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpConvertTargetInfo + 70 77E176C7 51 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpConvertTargetInfo + 122 77E176FB 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpConvertTargetInfo + 165 77E17726 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpConvertTargetInfo + 169 77E1772A 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredpConvertTargetInfo + 224 77E17761 32 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteA + 43 77E17A94 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteA + 71 77E17AB0 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteA + 83 77E17ABC 122 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteW + 46 77E17B37 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteW + 50 77E17B3B 53 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteW + 104 77E17B71 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteW + 108 77E17B75 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteW + 121 77E17B82 25 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadA + 20 77E17BBD 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadA + 44 77E17BD5 130 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadA + 175 77E17C58 162 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadW + 122 77E17CFB 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadW + 148 77E17D15 126 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredEnumerateA + 60 77E17D95 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredEnumerateA + 62 77E17D97 191 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredEnumerateW + 14 77E17E57 98 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredEnumerateW + 113 77E17EBA 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredEnumerateW + 133 77E17ECE 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredEnumerateW + 141 77E17ED6 85 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredEnumerateW + 227 77E17F2C 63 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsA + 51 77E17F6C 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsA + 66 77E17F7B 12 Bytes JMP 77E17DF7 C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsA + 79 77E17F88 75 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsA + 155 77E17FD4 151 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsW + 99 77E1806C 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsW + 152 77E180A1 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsW + 158 77E180A7 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredWriteDomainCredentialsW + 195 77E180CC 75 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsA + 63 77E18118 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsA + 75 77E18124 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsA + 137 77E18162 95 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsA + 234 77E181C3 108 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsW + 103 77E18230 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsW + 116 77E1823D 77 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsW + 194 77E1828B 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredReadDomainCredentialsW + 207 77E18298 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteA + 24 77E182D1 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteA + 82 77E1830B 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteA + 84 77E1830D 125 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteW + 42 77E1838B 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteW + 100 77E183C5 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteW + 103 77E183C8 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteW + 117 77E183D6 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredDeleteW + 146 77E183F3 5 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameA + 21 77E1841E 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameA + 35 77E1842C 20 Bytes JMP 60E1769E
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameA + 56 77E18441 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameA + 124 77E18485 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameA + 140 77E18495 8 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameW + 36 77E18505 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameW + 69 77E18526 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameW + 112 77E18551 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameW + 161 77E18582 29 Bytes JMP 77E186BD C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredRenameW + 191 77E185A0 217 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetTargetInfoA + 195 77E1867C 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetTargetInfoA + 206 77E18687 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetTargetInfoW + 12 77E18695 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetTargetInfoW + 36 77E186AD 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetTargetInfoW + 52 77E186BD 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetTargetInfoW + 97 77E186EA 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetTargetInfoW + 117 77E186FE 7 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetSessionTypes + 113 77E187CA 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetSessionTypes + 132 77E187DD 208 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetSessionTypes + 341 77E188AE 76 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetSessionTypes + 418 77E188FB 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredGetSessionTypes + 422 77E188FF 13 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredMarshalCredentialW + 91 77E18BD1 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredMarshalCredentialW + 100 77E18BDA 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredMarshalCredentialW + 103 77E18BDD 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredMarshalCredentialW + 120 77E18BEE 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredMarshalCredentialW + 142 77E18C04 75 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredIsMarshaledCredentialW + 2 77E18C50 112 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredMarshalCredentialA + 69 77E18CC1 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredUnmarshalCredentialA + 1 77E18CC8 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredUnmarshalCredentialA + 47 77E18CF6 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredUnmarshalCredentialA + 83 77E18D1A 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredIsMarshaledCredentialA + 1 77E18D31 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredIsMarshaledCredentialA + 15 77E18D3F 306 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredIsMarshaledCredentialA + 322 77E18E72 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredIsMarshaledCredentialA + 333 77E18E7D 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CredIsMarshaledCredentialA + 343 77E18E87 27 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 22 77E192EE 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 64 77E19318 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 114 77E1934A 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 132 77E1935C 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 157 77E19375 26 Bytes JMP 6BA1C67C
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInformation + 31 77E19564 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInformation + 53 77E1957A 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInformation + 84 77E19599 11 Bytes JMP 01E189C7
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInformation + 96 77E195A5 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInformation + 102 77E195AB 83 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDeleteTrustedDomain + 38 77E1973B 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDeleteTrustedDomain + 42 77E1973F 107 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDeleteTrustedDomain + 150 77E197AB 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDeleteTrustedDomain + 183 77E197CC 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDeleteTrustedDomain + 205 77E197E2 38 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 42 77E19AC1 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 66 77E19AD9 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 91 77E19AF2 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 124 77E19B13 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 151 77E19B2E 277 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 228 77E19E26 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 232 77E19E2A 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 286 77E19E60 151 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 59 77E19EF8 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 108 77E19F29 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 121 77E19F36 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 149 77E19F52 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomainEx + 18 77E19F73 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomainEx + 23 77E19F78 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomainEx + 53 77E19F96 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomainEx + 69 77E19FA6 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomainEx + 82 77E19FB3 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 39 77E1A09C 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 46 77E1A0A3 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 57 77E1A0AE 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 69 77E1A0BA 66 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetDomainInformationPolicy + 12 77E1A0FD 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetDomainInformationPolicy + 49 77E1A122 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetDomainInformationPolicy + 63 77E1A130 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetDomainInformationPolicy + 75 77E1A13C 149 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenTrustedDomainByName + 97 77E1A1D2 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryForestTrustInformation + 32 77E1A201 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryForestTrustInformation + 34 77E1A203 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryForestTrustInformation + 64 77E1A221 63 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetForestTrustInformation + 16 77E1A261 16 Bytes JMP 77E1A6EB C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetForestTrustInformation + 33 77E1A272 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetForestTrustInformation + 71 77E1A298 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetForestTrustInformation + 105 77E1A2BA 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetForestTrustInformation + 120 77E1A2C9 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 39 77E1A911 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 43 77E1A915 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 70 77E1A930 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 80 77E1A93A 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 87 77E1A941 32 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaAddAccountRights + 80 77E1A9F1 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaAddAccountRights + 115 77E1AA14 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaAddAccountRights + 121 77E1AA1A 71 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaRemoveAccountRights + 34 77E1AA63 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaRemoveAccountRights + 42 77E1AA6B 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaRemoveAccountRights + 46 77E1AA6F 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaRemoveAccountRights + 57 77E1AA7A 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaRemoveAccountRights + 116 77E1AAB5 22 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenPolicySce + 47 77E1AC7F 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenPolicySce + 52 77E1AC84 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenPolicySce + 60 77E1AC8C 87 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenPolicySce + 149 77E1ACE5 93 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenPolicySce + 243 77E1AD43 6 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationPolicy + 26 77E1AD73 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationPolicy + 32 77E1AD79 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationPolicy + 83 77E1ADAC 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationPolicy + 140 77E1ADE5 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationPolicy + 142 77E1ADE7 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaClearAuditLog + 9 77E1AE22 109 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupPrivilegeName + 15 77E1AE90 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupPrivilegeName + 47 77E1AEB0 126 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 38 77E1AF2F 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 63 77E1AF48 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 67 77E1AF4C 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 86 77E1AF5F 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 155 77E1AFA4 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDelete + 8 77E1AFB9 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDelete + 12 77E1AFBD 153 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDelete + 167 77E1B058 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaDelete + 176 77E1B061 52 Bytes JMP 77E1AE4C C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecurityObject + 25 77E1B096 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecurityObject + 60 77E1B0B9 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecurityObject + 66 77E1B0BF 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecurityObject + 75 77E1B0C8 157 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecurityObject + 93 77E1B166 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecurityObject + 110 77E1B177 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecurityObject + 171 77E1B1B4 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecurityObject + 200 77E1B1D1 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecurityObject + 203 77E1B1D4 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateAccount + 17 77E1B1F2 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateAccount + 79 77E1B230 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateAccount + 83 77E1B234 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateAccount + 97 77E1B242 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccounts + 12 77E1B25D 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccounts + 53 77E1B286 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccounts + 56 77E1B289 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccounts + 83 77E1B2A4 46 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateAccounts + 130 77E1B2D3 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomain + 91 77E1B344 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomain + 104 77E1B351 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateTrustedDomain + 107 77E1B354 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenTrustedDomain + 16 77E1B371 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenTrustedDomain + 36 77E1B385 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenTrustedDomain + 43 77E1B38C 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenTrustedDomain + 55 77E1B398 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenTrustedDomain + 65 77E1B3A2 17 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQueryInfoTrustedDomain + 44 77E1B3FD 196 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationTrustedDomain + 81 77E1B4C2 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationTrustedDomain + 98 77E1B4D3 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationTrustedDomain + 101 77E1B4D6 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationTrustedDomain + 104 77E1B4D9 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetInformationTrustedDomain + 121 77E1B4EA 14 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateTrustedDomains + 87 77E1B65C 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumerateTrustedDomains + 94 77E1B663 93 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumeratePrivileges + 24 77E1B6C1 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumeratePrivileges + 41 77E1B6D2 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumeratePrivileges + 43 77E1B6D4 212 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateSecret + 104 77E1B7A9 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaCreateSecret + 136 77E1B7C9 14 Bytes JMP 77E1B8EA C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenAccount 77E1B7D9 65 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenAccount + 66 77E1B81B 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenAccount + 83 77E1B82C 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenAccount + 97 77E1B83A 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumeratePrivilegesOfAccount + 27 77E1B864 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaEnumeratePrivilegesOfAccount + 85 77E1B89E 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaAddPrivilegesToAccount + 17 77E1B8CA 81 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaAddPrivilegesToAccount + 99 77E1B91C 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaRemovePrivilegesFromAccount 77E1B929 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaRemovePrivilegesFromAccount + 63 77E1B968 68 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetQuotasForAccount + 20 77E1B9AD 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetQuotasForAccount + 23 77E1B9B0 73 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetQuotasForAccount + 97 77E1B9FA 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetQuotasForAccount 77E1BA09 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetQuotasForAccount + 26 77E1BA23 72 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetQuotasForAccount + 99 77E1BA6C 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetSystemAccessAccount + 30 77E1BA97 105 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSystemAccessAccount + 16 77E1BB01 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSystemAccessAccount + 30 77E1BB0F 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSystemAccessAccount + 36 77E1BB15 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSystemAccessAccount + 42 77E1BB1B 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSystemAccessAccount + 67 77E1BB34 27 Bytes JMP 77E1BC9C C:\WINDOWS\system32\ADVAPI32.dll
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenSecret + 48 77E1BB99 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaOpenSecret + 87 77E1BBC0 232 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecret + 209 77E1BCAA 98 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecret + 308 77E1BD0D 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecret + 312 77E1BD11 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecret + 330 77E1BD23 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaSetSecret + 343 77E1BD30 89 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecret + 77 77E1BD8A 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecret + 95 77E1BD9C 42 Bytes JMP 77E1BEA7 C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecret + 138 77E1BDC7 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecret + 167 77E1BDE4 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaQuerySecret + 184 77E1BDF5 16 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetRemoteUserName + 140 77E1BF91 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetRemoteUserName + 143 77E1BF94 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetRemoteUserName + 173 77E1BFB2 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetRemoteUserName + 199 77E1BFCC 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaGetRemoteUserName + 201 77E1BFCE 18 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupNamesWithCreds + 169 77E1C0CA 131 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupNamesWithCreds + 301 77E1C14E 94 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupNamesWithCreds + 399 77E1C1B0 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupSidsWithCreds + 32 77E1C1D1 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupSidsWithCreds + 35 77E1C1D4 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupSidsWithCreds + 58 77E1C1EB 46 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupSidsWithCreds + 105 77E1C21A 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaICLookupSidsWithCreds + 114 77E1C223 67 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupNames + 2 77E1C39B 91 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupNames + 94 77E1C3F7 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupNames + 121 77E1C412 119 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupNames + 241 77E1C48A 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!LsaLookupNames + 264 77E1C4A1 59 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UninstallApplication + 2 77E1CF06 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UninstallApplication + 6 77E1CF0A 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UninstallApplication + 15 77E1CF13 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UninstallApplication + 21 77E1CF19 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!UninstallApplication + 25 77E1CF1D 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplications + 9 77E1CF5B 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplications + 48 77E1CF82 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplications + 56 77E1CF8A 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplications + 62 77E1CF90 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplications + 66 77E1CF94 13 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplicationData + 52 77E1D1B7 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplicationData + 66 77E1D1C5 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplicationData + 77 77E1D1D0 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplicationData + 102 77E1D1E9 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetLocalManagedApplicationData + 117 77E1D1F8 28 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetManagedApplications + 113 77E1D418 123 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetManagedApplicationCategories + 55 77E1D496 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetManagedApplicationCategories + 75 77E1D4AA 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!InstallApplication + 25 77E1D4C8 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!InstallApplication + 31 77E1D4CE 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!InstallApplication + 80 77E1D4FF 163 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!InstallApplication + 244 77E1D5A3 87 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!InstallApplication + 332 77E1D5FB 38 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateCodeAuthzLevel + 69 77E1E702 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateCodeAuthzLevel + 94 77E1E71B 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateCodeAuthzLevel + 136 77E1E745 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateCodeAuthzLevel + 143 77E1E74C 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!CreateCodeAuthzLevel + 183 77E1E774 103 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!IsTokenUntrusted + 4 77E1E900 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!IsTokenUntrusted + 6 77E1E902 65 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!IsTokenUntrusted + 72 77E1E944 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!IsTokenUntrusted + 77 77E1E949 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!IsTokenUntrusted + 114 77E1E96E 31 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetPolicyInformation + 20 77E1F050 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetPolicyInformation + 63 77E1F07B 135 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetPolicyInformation + 199 77E1F103 156 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetPolicyInformation + 356 77E1F1A0 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetPolicyInformation + 382 77E1F1BA 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferRecordEventLogEntry + 26 77E1F407 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferRecordEventLogEntry + 50 77E1F41F 79 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferRecordEventLogEntry + 130 77E1F46F 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferRecordEventLogEntry + 154 77E1F487 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferRecordEventLogEntry + 163 77E1F490 57 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetLevelInformation + 26 77E201C7 69 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetLevelInformation + 96 77E2020D 103 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetLevelInformation + 200 77E20275 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetLevelInformation + 221 77E2028A 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferSetLevelInformation + 229 77E20292 119 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferiChangeRegistryScope + 73 77E2062E 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferiChangeRegistryScope + 101 77E2064A 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferiChangeRegistryScope + 113 77E20656 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferiChangeRegistryScope + 130 77E20667 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SaferiChangeRegistryScope + 136 77E2066D 4 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetNamedSecurityInfoA + 8 77E2154C 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetNamedSecurityInfoA + 49 77E21575 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetNamedSecurityInfoA + 53 77E21579 65 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SetNamedSecurityInfoA + 43 77E215BB 12 Bytes JMP 77E2165B C:\WINDOWS\system32\ADVAPI32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SetNamedSecurityInfoA + 56 77E215C8 134 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SetEntriesInAclA + 118 77E2164F 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SetEntriesInAclA + 147 77E2166C 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SetEntriesInAclA + 168 77E21681 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SetEntriesInAclA + 178 77E2168B 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!SetEntriesInAclA + 182 77E2168F 2 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetEffectiveRightsFromAclW + 33 77E217B8 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetEffectiveRightsFromAclW + 83 77E217EA 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetEffectiveRightsFromAclA + 2 77E217F9 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetEffectiveRightsFromAclA + 26 77E21811 122 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetAuditedPermissionsFromAclW + 30 77E2188C 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetAuditedPermissionsFromAclW + 36 77E21892 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ADVAPI32.dll!GetAuditedPermissionsFromAclA + 16
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm

Unread postby -JR- » November 7th, 2006, 1:21 am

.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeCmpStringHandles + 148 77D919D9 175 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeCreateStringHandleA + 142 77D91A89 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeCreateStringHandleA + 163 77D91A9E 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeCreateStringHandleA + 198 77D91AC1 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeCreateStringHandleA + 237 77D91AE8 194 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeFreeStringHandle + 131 77D91BAB 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeKeepStringHandle + 45 77D91BEF 117 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeQueryStringA + 24 77D91C66 244 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeQueryStringW + 240 77D91D5B 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetKBCodePage + 1 77D91D61 242 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetKBCodePage + 244 77D91E54 123 Bytes JMP 77D91C0D C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetKBCodePage + 368 77D91ED0 4 Bytes JMP 77D91BC2 C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetKBCodePage + 373 77D91ED5 119 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetKBCodePage + 493 77D91F4D 33 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListA + 15 77D934A6 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListA + 35 77D934BA 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListA + 42 77D934C1 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListA + 67 77D934DA 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListA + 80 77D934E7 15 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListW + 40 77D9354D 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListW + 51 77D93558 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListW + 54 77D9355B 147 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListW + 202 77D935EF 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirListW + 226 77D93607 141 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirSelectExA + 38 77D936DC 65 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirSelectExW + 2 77D9371E 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirSelectExW + 6 77D93722 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirSelectExW + 9 77D93725 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirSelectExW + 39 77D93743 103 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DlgDirSelectExW + 143 77D937AB 300 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ScrollChildren + 2 77D949B6 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ScrollChildren + 29 77D949D1 88 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ScrollChildren + 118 77D94A2A 55 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ScrollChildren + 175 77D94A63 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ScrollChildren + 178 77D94A66 59 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CascadeWindows + 31 77D94C10 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CascadeWindows + 75 77D94C3C 53 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CascadeWindows + 129 77D94C72 43 Bytes JMP 77D94D56 C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CascadeWindows + 173 77D94C9E 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CascadeWindows + 216 77D94CC9 23 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeMenuW + 53 77D94E4B 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeMenuW + 83 77D94E69 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeMenuW + 86 77D94E6C 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeMenuW + 128 77D94E96 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeMenuW + 144 77D94EA6 11 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!TrackPopupMenu + 7 77D94EDD 119 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DrawMenuBarTemp + 48 77D94F55 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CheckMenuRadioItem + 2 77D94F5C 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CheckMenuRadioItem + 59 77D94F95 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CheckMenuRadioItem + 69 77D94F9F 152 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CheckMenuRadioItem + 222 77D95038 69 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CheckMenuRadioItem + 292 77D9507E 38 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MB_GetString + 2 77D9590F 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MB_GetString + 4 77D95911 106 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MB_GetString + 111 77D9597C 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MB_GetString + 121 77D95986 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MB_GetString + 126 77D9598B 34 Bytes JMP 77D95632 C:\WINDOWS\system32\USER32.dll
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MessageBoxTimeoutW + 58 77D95F7B 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MessageBoxTimeoutW + 64 77D95F81 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MessageBoxTimeoutA + 1 77D95FC5 206 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MessageBoxIndirectW + 1 77D96094 53 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MessageBoxIndirectW + 55 77D960CA 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MessageBoxW + 22 77D96108 86 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetSysColors + 31 77D9615F 104 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetSysColors + 136 77D961C8 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetSysColors + 157 77D961DD 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetSysColors + 175 77D961EF 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetSysColors + 205 77D9620D 56 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ToUnicode + 44 77D96292 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ToUnicodeEx + 4 77D9629B 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetSystemCursor + 4 77D962CD 190 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!keybd_event + 75 77D9638C 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!keybd_event + 78 77D9638F 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!keybd_event + 108 77D963AD 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!keybd_event + 117 77D963B6 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!keybd_event + 146 77D963D3 79 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DrawCaption + 33 77D9697E 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DrawCaption + 78 77D969AB 94 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CharToOemBuffW + 25 77D96A0A 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!OemToCharW 77D96A36 66 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!OemToCharW + 67 77D96A79 177 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetSysColorsTemp + 173 77D96B2B 142 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!InitializeWin32EntryTable + 51 77D96BBA 65 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!InitializeWin32EntryTable + 117 77D96BFC 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!InitializeWin32EntryTable + 141 77D96C14 82 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!InitializeWin32EntryTable + 224 77D96C67 25 Bytes JMP AB97578B
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!InitializeWin32EntryTable + 250 77D96C81 19 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ReasonCodeNeedsComment + 10 77D972C9 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ReasonCodeNeedsBugID + 18 77D972E8 181 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ReasonCodeNeedsBugID + 200 77D9739E 292 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ReasonCodeNeedsBugID + 493 77D974C3 198 Bytes JMP 77D97680 C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ReasonCodeNeedsBugID + 692 77D9758A 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ReasonCodeNeedsBugID + 695 77D9758D 5 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BuildReasonArray + 4 77D979BA 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BuildReasonArray + 11 77D979C1 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BuildReasonArray + 31 77D979D5 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BuildReasonArray + 61 77D979F3 120 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BuildReasonArray + 182 77D97A6C 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DestroyReasons + 1 77D97A99 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DestroyReasons + 4 77D97A9C 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DestroyReasons + 36 77D97ABC 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetReasonTitleFromReasonCode + 10 77D97AEE 75 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetReasonTitleFromReasonCode + 86 77D97B3A 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetReasonTitleFromReasonCode + 90 77D97B3E 260 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!EnableScrollBar + 130 77D97C47 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!EnableScrollBar + 132 77D97C49 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!EnableScrollBar + 150 77D97C5B 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!EnableScrollBar + 159 77D97C64 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!EnableScrollBar + 164 77D97C69 136 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CharNextExA + 47 77D9943D 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CharPrevExA 77D99442 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CharPrevExA + 11 77D9944D 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CharPrevExA + 17 77D99453 112 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CharPrevExA + 130 77D994C4 90 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CharPrevExA + 221 77D9951F 8 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!AnyPopup + 6 77D997ED 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!AnyPopup + 17 77D997F8 100 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsHungAppWindow + 60 77D9985D 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsHungAppWindow + 78 77D9986F 80 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsHungAppWindow + 159 77D998C0 241 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsHungAppWindow + 401 77D999B2 92 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsHungAppWindow + 494 77D99A0F 5 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsGUIThread + 41 77D99D88 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsGUIThread + 53 77D99D94 80 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsCharUpperW + 70 77D99DE5 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsCharUpperW + 91 77D99DFA 111 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsCharUpperW + 203 77D99E6A 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsCharUpperW + 222 77D99E7D 208 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IsCharUpperW + 431 77D99F4E 74 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdePostAdvise + 52 77D99F99 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdePostAdvise + 56 77D99F9D 100 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdePostAdvise + 157 77D9A002 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdePostAdvise + 184 77D9A01D 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdePostAdvise + 207 77D9A034 4 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeClientTransaction + 64 77D9A2A2 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeClientTransaction + 82 77D9A2B4 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeClientTransaction + 97 77D9A2C3 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeClientTransaction + 140 77D9A2EE 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeClientTransaction + 203 77D9A32D 24 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeQueryConvInfo + 14 77D9A774 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeQueryConvInfo + 20 77D9A77A 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeQueryConvInfo + 43 77D9A791 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeQueryConvInfo + 78 77D9A7B4 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeQueryConvInfo + 105 77D9A7CF 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeSetUserHandle + 64 77D9A929 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeSetUserHandle + 79 77D9A938 105 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeAbandonTransaction + 94 77D9A9A2 22 Bytes JMP 77D9AB14 C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeAbandonTransaction + 117 77D9A9B9 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DdeAbandonTransaction + 120 77D9A9BC 203 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BroadcastSystemMessage + 10 77D9AA88 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BroadcastSystemMessage + 22 77D9AA94 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetWindowModuleFileName + 14 77D9AAB2 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetWindowModuleFileName + 21 77D9AAB9 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetWindowModuleFileName + 36 77D9AAC8 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRawInputDeviceInfoA + 2 77D9AACF 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRawInputDeviceInfoA + 23 77D9AAE4 82 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRawInputDeviceInfoA + 107 77D9AB38 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRawInputDeviceInfoA + 150 77D9AB63 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRawInputDeviceInfoA + 171 77D9AB78 22 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MapVirtualKeyExA + 133 77D9ACDC 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SendMessageCallbackA + 27 77D9AD04 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SendMessageCallbackA + 34 77D9AD0B 64 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!VkKeyScanExA + 1 77D9AD4C 207 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CallMsgFilter + 70 77D9AE1C 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CallMsgFilter + 115 77D9AE49 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CallMsgFilter + 121 77D9AE4F 47 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!CallMsgFilter + 169 77D9AE7F 76 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DrawCaptionTempA + 60 77D9AECC 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DrawCaptionTempA + 65 77D9AED1 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DrawCaptionTempA + 118 77D9AF06 37 Bytes JMP 77D9B0AD C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!RealGetWindowClass + 1 77D9AF2C 125 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetAltTabInfo + 14 77D9AFAA 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeDisplaySettingsA + 27 77D9AFDB 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeDisplaySettingsA + 30 77D9AFDE 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeDisplaySettingsA + 34 77D9AFE2 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeDisplaySettingsA + 44 77D9AFEC 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ChangeDisplaySettingsA + 89 77D9B019 84 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPGetIMEW + 7 77D9B06E 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPGetIMEA + 1 77D9B079 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPQueryIMEA + 7 77D9B0A1 74 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPSetIMEA + 48 77D9B0EC 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPSetIMEA + 90 77D9B116 41 Bytes JMP 77D9B2A0 C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPSetIMEA + 132 77D9B140 8 Bytes JMP 77D9B35A C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPSetIMEA + 141 77D9B149 9 Bytes JMP 77D9B291 C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!IMPSetIMEA + 151 77D9B153 50 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!BlockInput 77D9C636 99 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DragObject 77D9C69A 104 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!DrawAnimatedRects + 85 77D9C703 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!EndMenu + 36 77D9C736 124 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetGuiResources + 25 77D9C7B3 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetGuiResources + 27 77D9C7B5 36 Bytes JMP 77D9C85A C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetInternalWindowPos + 25 77D9C7DB 81 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetMenuItemRect + 7 77D9C82D 116 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRawInputDeviceList + 5 77D9C8A3 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRegisteredRawInputDevices + 7 77D9C8B9 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetRegisteredRawInputDevices + 15 77D9C8C1 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!HiliteMenuItem + 7 77D9C8E1 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!ImpersonateDdeClientWindow + 25 77D9C907 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!LockWorkStation + 7 77D9C91D 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MenuItemFromPoint + 5 77D9C92D 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!MenuItemFromPoint + 62 77D9C966 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!QueryUserCounters + 7 77D9C991 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!RealChildWindowFromPoint + 4 77D9C9A2 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!RealChildWindowFromPoint + 11 77D9C9A9 55 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!RegisterTasklist + 7 77D9C9E1 47 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetClassWord + 15 77D9CA11 71 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetInternalWindowPos + 7 77D9CA59 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetInternalWindowPos + 11 77D9CA5D 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetMenuContextHelpId + 7 77D9CA81 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!SetMenuContextHelpId + 25 77D9CA93 83 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!PrivateSetRipFlags + 49 77D9CAE7 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!PrivateSetRipFlags + 51 77D9CAE9 92 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!UnregisterHotKey + 4 77D9CB46 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!UnregisterHotKey + 11 77D9CB4D 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!UnregisterHotKey + 25 77D9CB5B 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!UnregisterHotKey + 27 77D9CB5D 27 Bytes JMP 77D9CA6E C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!UnregisterHotKey + 55 77D9CB79 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!GetLayeredWindowAttributes + 4 77D9CB82 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!UserHandleGrantAccess + 5 77D9CB97 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!UserHandleGrantAccess + 25 77D9CBAB 107 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!Win32PoolAllocationStats + 93 77D9CC17 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!Win32PoolAllocationStats + 105 77D9CC23 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!Win32PoolAllocationStats + 150 77D9CC50 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!Win32PoolAllocationStats + 199 77D9CC81 127 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!Win32PoolAllocationStats + 327 77D9CD01 30 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!AlignRects + 4 77D9D09C 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!AlignRects + 40 77D9D0C0 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!AlignRects + 48 77D9D0C8 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!AlignRects + 56 77D9D0D0 244 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!AlignRects + 301 77D9D1C5 97 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!VRipOutput + 107 77D9DAEE 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!VRipOutput + 129 77D9DB04 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!VRipOutput + 143 77D9DB12 208 Bytes JMP 77D9DA00 C:\WINDOWS\system32\USER32.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!VRipOutput + 352 77D9DBE3 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USER32.dll!VRipOutput + 408 77D9DC1B 20 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetAdapterIpAddress + -68961 76D611F5 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetAdapterIpAddress + -68938 76D6120C 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetAdapterIpAddress + -68274 76D614A4 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetAdapterIpAddress + -68262 76D614B0 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetAdapterIpAddress + -68246 76D614C0 10 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatsFromStack + 31 76D62753 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatsFromStack + 36 76D62758 84 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatsFromStack + 121 76D627AD 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatsFromStack + 164 76D627D8 85 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatsFromStack + 250 76D6282E 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetInterfaceInfo + 27 76D6285C 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetInterfaceInfo + 37 76D62866 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetInterfaceInfo + 96 76D628A1 150 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdapterOrderMap + 105 76D62938 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdapterOrderMap + 151 76D62966 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdapterOrderMap + 166 76D62975 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdapterOrderMap + 201 76D62998 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdapterOrderMap + 221 76D629AC 49 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUniDirectionalAdapterInfo + 36 76D62D3C 130 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUniDirectionalAdapterInfo + 167 76D62DBF 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUniDirectionalAdapterInfo + 209 76D62DE9 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUniDirectionalAdapterInfo + 231 76D62DFF 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUniDirectionalAdapterInfo + 246 76D62E0E 44 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTableFromStack + 7 76D63A75 82 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTableFromStack + 91 76D63AC9 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTableFromStack + 93 76D63ACB 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTableFromStack + 132 76D63AF2 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTableFromStack + 141 76D63AFB 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntryFromStack + 2 76D63B0A 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntryFromStack + 19 76D63B1B 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntryFromStack + 27 76D63B23 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntryFromStack + 78 76D63B56 82 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTable + 13 76D63BA9 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTable + 20 76D63BB0 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTable + 66 76D63BDE 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTable + 89 76D63BF5 90 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpAddrTable + 180 76D63C50 21 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersAddresses + 16 76D63E64 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersAddresses + 75 76D63E9F 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersAddresses + 84 76D63EA8 64 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersAddresses + 149 76D63EE9 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersAddresses + 183 76D63F0B 54 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpSendEcho + 111 76D64BE8 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpSendEcho + 116 76D64BED 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpSendEcho + 147 76D64C0C 136 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpSendEcho + 284 76D64C95 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpSendEcho + 299 76D64CA4 26 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpParseReplies + 34 76D64CF8 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpParseReplies + 57 76D64D0F 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpParseReplies + 75 76D64D21 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpCloseHandle + 1 76D64D34 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpCreateFile + 9 76D64D67 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpCreateFile + 33 76D64D7F 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpCreateFile + 68 76D64DA2 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpCreateFile + 78 76D64DAC 80 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!IcmpCreateFile + 159 76D64DFD 50 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTableFromStack + 54 76D65093 103 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTableFromStack + 158 76D650FB 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTableFromStack + 203 76D65128 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTable + 31 76D65162 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTable + 45 76D65170 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTable + 63 76D65182 88 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTable + 152 76D651DB 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfTable + 157 76D651E0 150 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetNumberOfInterfaces + 9 76D65277 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetNumberOfInterfaces + 25 76D65287 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetNumberOfInterfaces + 39 76D65295 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetNumberOfInterfaces + 54 76D652A4 105 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetNumberOfInterfaces + 160 76D6530E 2 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetArpEntTableFromStack + 45 76D65CC9 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetArpEntTableFromStack + 61 76D65CD9 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetArpEntTableFromStack + 105 76D65D05 55 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetArpEntTableFromStack + 161 76D65D3D 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetArpEntTableFromStack + 179 76D65D4F 45 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersInfo + 105 76D660BA 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersInfo + 141 76D660DE 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersInfo + 154 76D660EB 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersInfo + 193 76D66112 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetAdaptersInfo + 219 76D6612C 106 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!NotifyAddrChange + 81 76D66351 96 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIpAddrTableFromStack + 47 76D663B2 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIpAddrTableFromStack + 74 76D663CD 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIpAddrTableFromStack + 96 76D663E3 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntry + 50 76D66421 210 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntry + 261 76D664F4 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntry + 319 76D6652E 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntry + 342 76D66545 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIfEntry + 359 76D66556 292 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetPerAdapterInfo + 29 76D66786 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetPerAdapterInfo + 51 76D6679C 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetPerAdapterInfo + 66 76D667AB 4 Bytes JMP 76D66839 C:\WINDOWS\system32\iphlpapi.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetPerAdapterInfo + 71 76D667B0 111 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetPerAdapterInfo + 183 76D66820 44 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!NhGetInterfaceNameFromDeviceGuid + 58 76D66AAD 132 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!NhpAllocateAndGetInterfaceInfoFromStack + 74 76D66B32 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!NhpAllocateAndGetInterfaceInfoFromStack + 87 76D66B3F 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!NhpAllocateAndGetInterfaceInfoFromStack + 90 76D66B42 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!NhpAllocateAndGetInterfaceInfoFromStack + 124 76D66B64 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!NhpAllocateAndGetInterfaceInfoFromStack + 134 76D66B6E 21 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIfTableFromStack + 94 76D67012 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIfTableFromStack + 129 76D67035 77 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIfTableFromStack + 207 76D67083 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIpForwardTableFromStack + 12 76D670B6 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIpForwardTableFromStack + 54 76D670E0 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIpForwardTableFromStack + 81 76D670FB 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!AllocateAndGetIpForwardTableFromStack + 108 76D67116 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTableFromStack + 2 76D67133 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTableFromStack + 34 76D67153 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTableFromStack + 70 76D67177 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTableFromStack + 90 76D6718B 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTableFromStack + 114 76D671A3 38 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetFriendlyIfIndex + 6 76D69652 262 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetFriendlyIfIndex + 269 76D69759 188 Bytes JMP 04D22260
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetFriendlyIfIndex + 458 76D69816 19 Bytes JMP 6ACE9B1D
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetFriendlyIfIndex + 478 76D6982A 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetFriendlyIfIndex + 529 76D6985D 50 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpNetTable + 45 76D6998F 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpNetTable + 70 76D699A8 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpNetTable + 106 76D699CC 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpNetTable + 132 76D699E6 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpNetTable + 155 76D699FD 27 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatisticsEx + 136 76D69B55 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatisticsEx + 140 76D69B59 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatisticsEx + 157 76D69B6A 51 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatistics + 12 76D69B9F 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpStatistics + 46 76D69BC1 105 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIcmpStatistics + 5 76D69C2F 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIcmpStatistics + 56 76D69C62 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIcmpStatisticsEx + 2 76D69C70 73 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIcmpStatisticsEx + 76 76D69CBA 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIcmpStatisticsEx + 109 76D69CDB 118 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpStatisticsEx + 62 76D69D52 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpStatisticsEx + 83 76D69D67 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpStatisticsEx + 90 76D69D6E 95 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpStatistics + 86 76D69DCE 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpStatistics + 127 76D69DF7 23 Bytes JMP 76D69E94 C:\WINDOWS\system32\iphlpapi.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpStatisticsEx + 15 76D69E0F 93 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpStatistics + 9 76D69E6D 90 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpStatistics + 100 76D69EC8 128 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetIfEntry + 94 76D69F4A 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateIpForwardEntry + 20 76D69F69 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateIpForwardEntry + 34 76D69F77 76 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetIpForwardEntry + 17 76D69FC4 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetIpForwardEntry + 77 76D6A000 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteIpForwardEntry + 21 76D6A026 68 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteIpForwardEntry + 90 76D6A06B 53 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetIpStatistics + 43 76D6A0A1 75 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateIpNetEntry + 31 76D6A0EE 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateIpNetEntry + 48 76D6A0FF 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateIpNetEntry + 56 76D6A107 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateIpNetEntry + 67 76D6A112 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateIpNetEntry + 70 76D6A115 88 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetIpNetEntry + 51 76D6A16F 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteIpNetEntry + 30 76D6A1B3 91 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!FlushIpNetTable + 33 76D6A20F 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!FlushIpNetTable + 75 76D6A239 91 Bytes JMP 76D6A0BE C:\WINDOWS\system32\iphlpapi.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetTcpEntry + 67 76D6A295 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetTcpEntry + 69 76D6A297 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetTcpEntry + 77 76D6A29F 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!SetTcpEntry + 83 76D6A2A5 113 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetBestInterface + 109 76D6A317 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetBestInterface + 121 76D6A323 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetBestInterfaceEx + 1 76D6A35C 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetBestInterfaceEx + 56 76D6A393 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetBestInterfaceEx + 113 76D6A3CC 127 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!CreateProxyArpEntry + 12 76D6A44C 509 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteProxyArpEntry + 298 76D6A64A 361 Bytes JMP 76D6AAA7 C:\WINDOWS\system32\iphlpapi.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteProxyArpEntry + 661 76D6A7B5 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteProxyArpEntry + 689 76D6A7D1 95 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteProxyArpEntry + 785 76D6A831 8 Bytes JMP 76D6AA84 C:\WINDOWS\system32\iphlpapi.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!DeleteProxyArpEntry + 794 76D6A83A 154 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTable + 46 76D6AAF5 70 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTable + 119 76D6AB3E 193 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTable + 313 76D6AC00 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTable + 317 76D6AC04 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetIpForwardTable + 324 76D6AC0B 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpTable + 20 76D6AC31 46 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpTable + 67 76D6AC60 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetTcpTable + 95 76D6AC7C 198 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetExtendedTcpTable + 140 76D6AD43 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetExtendedTcpTable + 183 76D6AD6E 94 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetExtendedTcpTable + 278 76D6ADCD 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetExtendedTcpTable + 298 76D6ADE1 25 Bytes JMP 76D6AC01 C:\WINDOWS\system32\iphlpapi.dll
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetExtendedTcpTable + 324 76D6ADFB 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcpEntry + 17 76D6B011 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcpEntry + 23 76D6B017 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcpEntry + 30 76D6B01E 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcpEntry + 70 76D6B046 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcp6Entry + 17 76D6B05C 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcp6Entry + 23 76D6B062 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcp6Entry + 30 76D6B069 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetOwnerModuleFromTcp6Entry + 70 76D6B091 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpTable + 20 76D6B0AA 73 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpTable + 96 76D6B0F6 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpTable + 114 76D6B108 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpTable + 128 76D6B116 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] iphlpapi.dll!GetUdpTable + 144 76D6B126 24 Bytes
.text C:\WIND
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm

Unread postby -JR- » November 7th, 2006, 1:22 am

.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HBITMAP_UserUnmarshal + 28 775B9BA5 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HBITMAP_UserUnmarshal + 65 775B9BCA 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HBITMAP_UserUnmarshal + 106 775B9BF3 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HBITMAP_UserUnmarshal + 147 775B9C1C 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HBITMAP_UserUnmarshal + 162 775B9C2B 2 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILEPICT_UserFree + 42 775B9D92 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILEPICT_UserFree + 91 775B9DC3 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HENHMETAFILE_UserUnmarshal + 28 775B9DE4 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HENHMETAFILE_UserUnmarshal + 65 775B9E09 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HENHMETAFILE_UserFree + 14 775B9E1C 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HENHMETAFILE_UserFree + 37 775B9E33 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserSize + 19 775B9E4B 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserSize + 46 775B9E66 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserSize + 48 775B9E68 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserSize + 66 775B9E7A 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserMarshal + 22 775B9E95 41 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserMarshal + 64 775B9EBF 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserMarshal + 66 775B9EC1 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserMarshal + 122 775B9EF9 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserMarshal + 125 775B9EFC 37 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserUnmarshal + 32 775B9F47 39 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserUnmarshal + 73 775B9F70 100 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserUnmarshal + 174 775B9FD5 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserUnmarshal + 187 775B9FE2 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HMETAFILE_UserFree + 14 775B9FFB 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserSize + 21 775BA02C 45 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserSize + 67 775BA05A 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserMarshal + 23 775BA076 61 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserMarshal + 85 775BA0B4 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserMarshal + 107 775BA0CA 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserMarshal + 138 775BA0E9 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserMarshal + 141 775BA0EC 38 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserUnmarshal + 28 775BA290 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HPALETTE_UserUnmarshal + 65 775BA2B5 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HBITMAP_UserFree + 14 775BA2C8 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!HBITMAP_UserFree + 37 775BA2DF 72 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserSize + 68 775BA328 116 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserMarshal + 112 775BA39D 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserMarshal + 151 775BA3C4 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserUnmarshal + 32 775BA3E9 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserUnmarshal + 83 775BA41C 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserUnmarshal + 109 775BA436 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserUnmarshal + 152 775BA461 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserUnmarshal + 160 775BA469 9 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserFree + 14 775BA539 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserFree + 32 775BA54B 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserFree + 46 775BA559 80 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserFree + 127 775BA5AA 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SNB_UserFree + 182 775BA5E1 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleLockRunning + 22 775C888C 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleLockRunning + 81 775C88C7 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleSetContainedObject + 22 775C88E2 55 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleSetContainedObject + 78 775C891A 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleNoteObjectVisible + 22 775C8935 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleNoteObjectVisible + 46 775C894D 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleNoteObjectVisible + 76 775C896B 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleNoteObjectVisible + 97 775C8980 34 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleNoteObjectVisible + 132 775C89A3 35 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!GetDocumentBitStg + 32 775C8C31 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SetDocumentBitStg + 27 775C8C51 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!SetDocumentBitStg + 41 775C8C5F 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!GetConvertStg + 39 775C8C8B 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDraw + 23 775C8CA7 55 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDraw + 79 775C8CDF 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDraw + 128 775C8D10 62 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDraw + 191 775C8D4F 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDraw + 196 775C8D54 9 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDuplicateData + 21 775C8F67 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDuplicateData + 36 775C8F76 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDuplicateData + 66 775C8F94 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDuplicateData + 71 775C8F99 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleDuplicateData + 84 775C8FA6 5 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateStaticFromData + 71 775C9721 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateStaticFromData + 97 775C973B 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateStaticFromData + 115 775C974D 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateStaticFromData + 145 775C976B 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateStaticFromData + 158 775C9778 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkEx + 12 775C9B4A 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkEx + 25 775C9B57 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkEx + 51 775C9B71 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkEx + 57 775C9B77 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkEx + 70 775C9B84 119 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkToFileEx + 86 775C9C72 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkToFileEx + 112 775C9C8C 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkToFileEx + 115 775C9C8F 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkToFileEx + 145 775C9CAD 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkToFileEx + 185 775C9CD5 33 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFileEx + 17 775C9DF1 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFileEx + 21 775C9DF5 56 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFileEx + 80 775C9E30 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFileEx + 106 775C9E4A 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFileEx + 109 775C9E4D 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLink + 47 775CA12F 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLink + 70 775CA146 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkToFile + 47 775CA17A 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateLinkToFile + 70 775CA191 49 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFile + 47 775CA1C5 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFile + 73 775CA1DF 76 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFile + 150 775CA22C 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFile + 162 775CA238 48 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateFromFile + 213 775CA26B 56 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!CreateDataCache + 10 775CC015 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!CreateDataCache + 14 775CC019 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!CreateDataCache + 52 775CC03F 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!CreateDataCache + 90 775CC065 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!CreateDataCache + 110 775CC079 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!DoDragDrop + 12 775D03FD 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!DoDragDrop + 16 775D0401 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!DoDragDrop + 71 775D0438 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!DoDragDrop + 93 775D044E 29 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!DoDragDrop + 123 775D046C 65 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateEmbeddingHelper + 61 775D1B1C 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateEmbeddingHelper + 68 775D1B23 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateEmbeddingHelper + 73 775D1B28 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateEmbeddingHelper + 80 775D1B2F 67 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateEmbeddingHelper + 149 775D1B74 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateDefaultHandler + 13 775D1BE4 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateDefaultHandler + 15 775D1BE6 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateDefaultHandler + 30 775D1BF5 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateDefaultHandler + 46 775D1C05 59 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleCreateDefaultHandler + 106 775D1C41 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleSetAutoConvert + 11 775D1C51 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleSetAutoConvert + 23 775D1C5D 75 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleSetAutoConvert + 99 775D1CA9 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleSetAutoConvert + 102 775D1CAC 73 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleSetAutoConvert + 176 775D1CF6 32 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleMetafilePictFromIconAndLabel + 11 775D279A 43 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleMetafilePictFromIconAndLabel + 55 775D27C6 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleMetafilePictFromIconAndLabel + 64 775D27CF 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleMetafilePictFromIconAndLabel + 85 775D27E4 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleMetafilePictFromIconAndLabel + 126 775D280D 27 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfFile + 11 775D2C52 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfFile + 56 775D2C7F 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfFile + 84 775D2C9B 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfFile + 95 775D2CA6 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfFile + 111 775D2CB6 12 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfClass + 11 775D2F3C 125 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfClass + 139 775D2FBC 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfClass + 150 775D2FC7 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfClass + 205 775D2FFE 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleGetIconOfClass + 208 775D3001 97 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleRegEnumFormatEtc + 38 775D3DC7 50 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleRegEnumFormatEtc + 89 775D3DFA 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleRegEnumFormatEtc + 96 775D3E01 81 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleRegEnumFormatEtc + 178 775D3E53 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleRegEnumFormatEtc + 199 775D3E68 8 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertIStorageToOLESTREAM + 86 775D96C2 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertIStorageToOLESTREAMEx + 17 775D96D8 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertIStorageToOLESTREAMEx + 21 775D96DC 33 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertIStorageToOLESTREAMEx + 55 775D96FE 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertIStorageToOLESTREAMEx + 86 775D971D 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertIStorageToOLESTREAMEx + 93 775D9724 9 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorage + 88 775D9A0A 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorage + 95 775D9A11 60 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorage + 156 775D9A4E 77 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorageEx + 74 775D9A9D 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorageEx + 102 775D9AB9 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorageEx + 106 775D9ABD 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorageEx + 138 775D9ADD 89 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!OleConvertOLESTREAMToIStorageEx + 228 775D9B37 4 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd16Info + 19 775DA761 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd16Info + 26 775DA768 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd16Info + 85 775DA7A3 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd16Info + 92 775DA7AA 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd16Info + 96 775DA7AE 52 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd16toDvtd32 + 11 775DA883 96 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd16toDvtd32 + 108 775DA8E4 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd16toDvtd32 + 114 775DA8EA 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd16toDvtd32 + 117 775DA8ED 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd16toDvtd32 + 125 775DA8F5 28 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd32Info + 19 775DAA7C 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd32Info + 26 775DAA83 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd32Info + 59 775DAAA4 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd32Info + 68 775DAAAD 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtGetDvtd32Info + 87 775DAAC0 17 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd32toDvtd16 + 11 775DAB84 103 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd32toDvtd16 + 115 775DABEC 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd32toDvtd16 + 121 775DABF2 129 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd32toDvtd16 + 252 775DAC75 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!UtConvertDvtd32toDvtd16 + 263 775DAC80 164 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenStorageOnILockBytes + 83 775DC0E3 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenStorageOnILockBytes + 90 775DC0EA 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenStorageOnILockBytes + 115 775DC103 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenStorageOnILockBytes + 123 775DC10B 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenStorageOnILockBytes + 127 775DC10F 21 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgIsStorageILockBytes + 38 775DC40B 70 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgIsStorageILockBytes + 109 775DC452 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgIsStorageILockBytes + 133 775DC46A 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgIsStorageILockBytes + 175 775DC494 30 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgIsStorageILockBytes + 207 775DC4B4 26 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantChangeType + 21 775E3A4C 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantChangeType + 46 775E3A65 42 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantChangeType + 89 775E3A90 58 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantChangeType + 148 775E3ACB 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantChangeType + 155 775E3AD2 7 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!FmtIdToPropStgName + 82 775E3B4F 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!FmtIdToPropStgName + 91 775E3B58 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropStgNameToFmtId + 9 775E3B66 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropStgNameToFmtId + 14 775E3B6B 57 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropStgNameToFmtId + 73 775E3BA6 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropStgNameToFmtId + 78 775E3BAB 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropStgNameToFmtId + 87 775E3BB4 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropStg + 32 775E3BD9 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropStg + 39 775E3BE0 11 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropStg + 52 775E3BED 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropStg + 82 775E3C0B 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropStg + 110 775E3C27 4 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenPropStg + 33 775E3D5B 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenPropStg + 40 775E3D62 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenPropStg + 53 775E3D6F 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenPropStg + 81 775E3D8B 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenPropStg + 89 775E3D93 23 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropSetStg + 28 775E3EB8 69 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropSetStg + 98 775E3EFE 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropSetStg + 125 775E3F19 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropSetStg + 145 775E3F2D 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgCreatePropSetStg + 182 775E3F52 8 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropSysFreeString + 9 775E40F9 54 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropSysFreeString + 65 775E4131 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropSysFreeString + 78 775E413E 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropSysFreeString + 101 775E4155 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropSysFreeString + 129 775E4171 10 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantCopy + 12 775E4326 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantCopy + 24 775E4332 24 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantCopy + 50 775E434C 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantCopy + 54 775E4350 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!PropVariantCopy + 60 775E4356 26 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertVariantToProperty + 12 775E5DCA 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertVariantToProperty + 17 775E5DCF 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertVariantToProperty + 44 775E5DEA 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertVariantToProperty + 64 775E5DFE 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgPropertyLengthAsVariant + 31 775E5E22 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgPropertyLengthAsVariant + 51 775E5E36 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertPropertyToVariant + 31 775E5E5A 19 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertPropertyToVariant + 51 775E5E6E 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertPropertyToVariant + 60 775E5E77 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertPropertyToVariant + 64 775E5E7B 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgConvertPropertyToVariant + 87 775E5E92 20 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnILockBytes + 38 775F05AA 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnILockBytes + 62 775F05C2 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnILockBytes + 89 775F05DD 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnILockBytes + 102 775F05EA 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnILockBytes + 114 775F05F6 14 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 30 775F0669 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 38 775F0671 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 74 775F0695 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 81 775F069C 40 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 123 775F06C6 80 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnFile + 14 775F0806 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnFile + 34 775F081A 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnFile + 66 775F083A 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnFile + 73 775F0841 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] ole32.dll!StgGetIFillLockBytesOnFile + 98 775F085A 36 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopResetPolicySettingStatus + -584986 769C14DD 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopResetPolicySettingStatus + -584970 769C14ED 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopResetPolicySettingStatus + -584966 769C14F1 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopResetPolicySettingStatus + -584958 769C14F9 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopResetPolicySettingStatus + -584922 769C151D 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryW + 11 769C635A 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryW + 26 769C6369 31 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryW + 59 769C638A 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryW + 65 769C6390 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryW + 73 769C6398 16 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryW + 18 769C66AB 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryW + 22 769C66AF 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryW + 38 769C66BF 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryW + 76 769C66E5 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryW + 110 769C6707 12 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CreateEnvironmentBlock + 30 769C69AB 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CreateEnvironmentBlock + 45 769C69BA 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CreateEnvironmentBlock + 63 769C69CC 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CreateEnvironmentBlock + 75 769C69D8 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CreateEnvironmentBlock + 90 769C69E7 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryW + 18 769C75B5 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryW + 22 769C75B9 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryW + 38 769C75C9 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryW + 76 769C75EF 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryW + 110 769C7611 12 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserW + 39 769C7752 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserW + 56 769C7763 18 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserW + 76 769C7777 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserW + 83 769C777E 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserW + 106 769C7795 4 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DestroyEnvironmentBlock + 9 769C7C9E 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DestroyEnvironmentBlock + 15 769C7CA4 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DestroyEnvironmentBlock + 31 769C7CB4 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DestroyEnvironmentBlock + 33 769C7CB6 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DestroyEnvironmentBlock + 35 769C7CB8 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RegisterGPNotification + 39 769C8688 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RegisterGPNotification + 56 769C8699 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RegisterGPNotification + 58 769C869B 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RegisterGPNotification + 64 769C86A1 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RegisterGPNotification + 81 769C86B2 7 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnregisterGPNotification + 44 769C875D 38 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnregisterGPNotification + 83 769C8784 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnregisterGPNotification + 95 769C8790 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnregisterGPNotification + 100 769C8795 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnregisterGPNotification + 107 769C879C 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForMachinePolicyForegroundProcessing + 15 769C8A59 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForMachinePolicyForegroundProcessing + 17 769C8A5B 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForMachinePolicyForegroundProcessing + 33 769C8A6B 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForMachinePolicyForegroundProcessing + 51 769C8A7D 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForMachinePolicyForegroundProcessing + 72 769C8A92 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfileType + 26 769C8F5B 65 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfileType + 92 769C8F9D 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfileType + 113 769C8FB2 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfileType + 120 769C8FB9 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfileType + 122 769C8FBB 4 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForUserPolicyForegroundProcessing + 15 769C915E 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForUserPolicyForegroundProcessing + 17 769C9160 15 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForUserPolicyForegroundProcessing + 33 769C9170 17 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForUserPolicyForegroundProcessing + 51 769C9182 21 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!WaitForUserPolicyForegroundProcessing + 73 769C9198 9 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetNextFgPolicyRefreshInfo + 13 769C95DC 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetNextFgPolicyRefreshInfo + 18 769C95E1 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetNextFgPolicyRefreshInfo + 22 769C95E5 14 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetNextFgPolicyRefreshInfo + 38 769C95F5 63 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetNextFgPolicyRefreshInfo + 102 769C9635 40 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileW + 5 769CA2CC 70 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileW + 77 769CA314 37 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileW + 115 769CA33A 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileW + 124 769CA343 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileW + 135 769CA34E 7 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopLoggingEnabled + 49 769CE728 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopLoggingEnabled + 102 769CE75D 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopLoggingEnabled + 104 769CE75F 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopLoggingEnabled + 106 769CE761 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RsopLoggingEnabled + 130 769CE779 3 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!EnterCriticalPolicySection + 7 769CF1F6 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!EnterCriticalPolicySection + 12 769CF1FB 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!EnterCriticalPolicySection + 20 769CF203 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!EnterCriticalPolicySection + 24 769CF207 52 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!EnterCriticalPolicySection + 77 769CF23C 18 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!FreeGPOListW + 16 769D1B47 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!FreeGPOListW + 23 769D1B4E 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!FreeGPOListW + 53 769D1B6C 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!FreeGPOListW + 65 769D1B78 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!FreeGPOListW + 78 769D1B85 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LeaveCriticalPolicySection + 17 769D446A 20 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LeaveCriticalPolicySection + 38 769D447F 25 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LeaveCriticalPolicySection + 64 769D4499 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LeaveCriticalPolicySection + 73 769D44A2 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LeaveCriticalPolicySection + 75 769D44A4 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryW + 22 76A0365F 22 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryW + 46 76A03677 28 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryW + 75 76A03694 16 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryW + 93 76A036A6 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryW + 121 76A036C2 11 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileA + 77 76A07458 173 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileA + 251 76A07506 3 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileA + 255 76A0750A 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileA + 257 76A0750C 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!LoadUserProfileA + 259 76A0750E 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryA + 50 76A07B81 146 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryA + 197 76A07C14 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryA + 203 76A07C1A 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryA + 205 76A07C1C 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetProfilesDirectoryA + 207 76A07C1E 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryA + 24 76A07CEB 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryA + 50 76A07D05 146 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryA + 197 76A07D98 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryA + 199 76A07D9A 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetDefaultUserProfileDirectoryA + 201 76A07D9C 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryA + 50 76A07EA7 146 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryA + 197 76A07F3A 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryA + 205 76A07F42 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryA + 207 76A07F44 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAllUsersProfileDirectoryA + 209 76A07F46 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryA + 50 76A08049 149 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryA + 200 76A080DF 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryA + 203 76A080E2 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryA + 205 76A080E4 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetUserProfileDirectoryA + 207 76A080E6 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserA + 168 76A083E1 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserA + 177 76A083EA 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserA + 179 76A083EC 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserA + 181 76A083EE 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!ExpandEnvironmentStringsForUserA + 183 76A083F0 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetGPOListA + 98 76A0898B 26 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetGPOListA + 125 76A089A6 12 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetGPOListA + 138 76A089B3 23 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetGPOListA + 162 76A089CB 2 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetGPOListA + 165 76A089CE 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!FreeGPOListA + 37 76A08A32 104 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!FreeGPOListA + 142 76A08A9B 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAppliedGPOListA + 9 76A08AA9 5 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAppliedGPOListA + 15 76A08AAF 32 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAppliedGPOListA + 48 76A08AD0 44 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAppliedGPOListA + 93 76A08AFD 13 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!GetAppliedGPOListA + 107 76A08B0B 8 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileA + 49 76A08BCC 95 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileA + 146 76A08C2D 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileA + 182 76A08C51 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileA + 191 76A08C5A 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileA + 193 76A08C5C 1 Byte
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CheckXForestLogon + 56 76A10835 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CheckXForestLogon + 58 76A10837 8 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CheckXForestLogon + 68 76A10841 36 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CheckXForestLogon + 107 76A10868 35 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!CheckXForestLogon + 145 76A1088E 7 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileW + 10 76A14B0B 131 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileW + 143 76A14B90 27 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileW + 172 76A14BAD 79 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileW + 252 76A14BFD 10 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!DeleteProfileW + 264 76A14C09 9 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnloadUserProfile + 75 76A1D4F2 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnloadUserProfile + 84 76A1D4FB 9 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnloadUserProfile + 95 76A1D506 7 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnloadUserProfile + 104 76A1D50F 6 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!UnloadUserProfile + 111 76A1D516 26 Bytes
.text ...
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RefreshPolicy + 174 76A2E50D 4 Bytes
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RefreshPolicy + 179 76A2E512 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RefreshPolicy + 181 76A2E514 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RefreshPolicy + 183 76A2E516 1 Byte
.text C:\WINDOWS\system32\taskmgr.exe[848] USERENV.dll!RefreshPolicy + 185 76A2E518 1 Byte
.text ...
-JR-
Active Member
 
Posts: 13
Joined: November 5th, 2006, 8:01 pm

Unread postby Kimberly » November 9th, 2006, 11:38 am

Hello -JR-

I had to split the topic, it seemed corrupted for some reason.

New topic and follow-up is located here:
http://www.malwareremoval.com/forum/viewtop ... 960#124960

Sorry for inconvenience.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 128 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware