GMER 1.0.12.12011 - http://www.gmer.net Rootkit scan 2009-11-07 08:02:18 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.12 ---- SSDT Lbd.sys ZwCreateKey SSDT Lbd.sys ZwSetValueKey Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateProcess Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateProcessEx Code \SystemRoot\system32\drivers\mfehidk.sys ZwMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys ZwOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys ZwOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys ZwProtectVirtualMemory Code \SystemRoot\system32\drivers\mfehidk.sys ZwSetContextThread Code \SystemRoot\system32\drivers\mfehidk.sys ZwSetInformationProcess Code \SystemRoot\system32\drivers\mfehidk.sys ZwTerminateProcess Code \SystemRoot\system32\drivers\mfehidk.sys ZwUnmapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys ZwYieldExecution Code \SystemRoot\system32\drivers\mfehidk.sys NtCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys NtMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys NtOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys NtOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys NtSetInformationProcess ---- Kernel code sections - GMER 1.0.12 ---- .text ntkrnlpa.exe!ZwYieldExecution 80504AE8 7 Bytes JMP A895C7B8 \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!NtCreateFile 80579084 5 Bytes JMP A895C78E \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!NtMapViewOfSection 805B2004 7 Bytes JMP A895C7CE \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805B2E12 5 Bytes JMP A895C7E4 \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 805B83E8 7 Bytes JMP A895C7A2 \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!NtOpenProcess 805CB40A 5 Bytes JMP A895C714 \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!NtOpenThread 805CB696 5 Bytes JMP A895C728 \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!NtSetInformationProcess 805CDE54 5 Bytes JMP A895C766 \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1144 7 Bytes JMP A895C750 \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!ZwCreateProcess 805D11FA 5 Bytes JMP A895C73C \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!ZwSetContextThread 805D1704 5 Bytes JMP A895C77A \SystemRoot\system32\drivers\mfehidk.sys PAGE ntkrnlpa.exe!ZwTerminateProcess 805D29AC 5 Bytes JMP A895C7FD \SystemRoot\system32\drivers\mfehidk.sys ---- User code sections - GMER 1.0.12 ---- .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00D10FEF .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00D10F55 .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00D10F66 .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D10040 .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00D10F8D .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00D1001B .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00D10F1D .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00D1006F .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00D10EE7 .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00D10F0C .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00D1009B .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00D10F9E .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D10FD4 .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00D10F44 .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00D10FB9 .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00D1000A .text C:\WINDOWS\SYSTEM32\services.exe[740] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00D10080 .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00D0003D .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00D00FCA .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00D0002C .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00D0001B .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00D00087 .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00D00000 .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00D00FDB .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ F0, 88 ] .text C:\WINDOWS\SYSTEM32\services.exe[740] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00D00062 .text C:\WINDOWS\SYSTEM32\services.exe[740] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CE000A .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BF0000 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BF0F55 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BF0F66 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BF0F8D .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BF004A .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BF0FA8 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BF0F13 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BF0065 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BF0EEE .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BF0087 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BF0098 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BF002F .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BF0FDB .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BF0F3A .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BF0FB9 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BF0FCA .text C:\WINDOWS\SYSTEM32\lsass.exe[760] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BF0076 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BE0FCA .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BE0F7C .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BE0025 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BE000A .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BE0F8D .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BE0FEF .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BE0FA8 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ DE, 88 ] .text C:\WINDOWS\SYSTEM32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BE0FB9 .text C:\WINDOWS\SYSTEM32\lsass.exe[760] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BC0FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00AA000A .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00AA0FA3 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00AA0098 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00AA007D .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00AA006C .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00AA0040 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00AA0F6B .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00AA0F92 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00AA00DF .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00AA0F50 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00AA00FA .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00AA0051 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00AA001B .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00AA00B3 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00AA0FCA .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00AA0FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[928] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00AA00CE .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00A90025 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00A9005B .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00A90000 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00A90FD4 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00A9004A .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00A90FE5 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00A90FA8 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ C9, 88 ] .text C:\WINDOWS\SYSTEM32\svchost.exe[928] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00A90FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[928] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00A70000 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C90FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C90062 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C90051 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C90040 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C90F8D .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C90FA8 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C90095 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C90084 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C90F28 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C900C1 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C900DC .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C9002F .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C90FDE .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C90073 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C90FC3 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C90014 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C900B0 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C80FAF .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C80F79 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C80FC0 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C80000 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C80036 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C80FE5 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C8001B .text C:\WINDOWS\SYSTEM32\svchost.exe[992] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C80F94 .text C:\WINDOWS\SYSTEM32\svchost.exe[992] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C60FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02010000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02010F44 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02010F5F .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02010F7C .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02010F97 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02010FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 0201005E .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 02010F18 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02010EE7 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02010080 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 0201009B .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 02010FA8 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0201001B .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 02010F29 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02010FD4 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 02010FE5 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 0201006F .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01D40FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01D40051 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01D40FD4 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01D4000A .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01D40040 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01D40FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01D4002F .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01D40FA8 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01D20000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01D10FE5 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 01D1000A .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01D10FD4 .text C:\WINDOWS\SYSTEM32\svchost.exe[1028] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 01D10FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00650000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00650F8F .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0065008E .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0065007D .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00650FC0 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00650FD1 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00650F72 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 006500BA .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 006500F0 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 006500DF .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 0065010B .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00650062 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00650025 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 006500A9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00650047 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00650036 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00650F61 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0064001B .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00640F94 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00640FCA .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00640000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00640051 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00640FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00640040 .text C:\WINDOWS\SYSTEM32\svchost.exe[1064] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00640FAF .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00660FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00660093 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00660078 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00660F9E .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0066005B .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00660040 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 006600E4 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 006600C9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 0066011A .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 006600FF .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00660F66 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00660FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00660FD4 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 006600AE .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0066002F .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00660014 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00660F81 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00650047 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00650FAF .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00650036 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0065001B .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00650FC0 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0065000A .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00650062 .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00650FDB .text C:\WINDOWS\SYSTEM32\svchost.exe[1188] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00630000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 009D0FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 009D0F3E .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 009D003D .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009D0F6F .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 009D002C .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 009D0FA5 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 009D0F17 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 009D005F .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009D00A6 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 009D0095 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009D0EF2 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 009D0F8A .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 009D0FCA .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 009D004E .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 009D0011 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 009D0000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 009D0084 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009C0F9E .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009C0F57 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009C0FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009C0FD4 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 009C0F72 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 009C0FE5 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 009C0F83 .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ BC, 88 ] .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 009C000A .text C:\WINDOWS\SYSTEM32\svchost.exe[1244] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006C0000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BB0FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BB006E .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BB0F83 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BB0051 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BB0040 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BB0025 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BB0F43 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BB0F54 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BB0F10 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BB0F21 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BB0EFF .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BB0F94 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BB0FDE .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BB007F .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BB0FC3 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BB000A .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BB0F32 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00660FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00660040 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00660014 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00660FDE .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00660F83 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00660FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0066002F .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00660FA8 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00630FE5 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00630000 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00630025 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00630036 .text C:\WINDOWS\SYSTEM32\svchost.exe[1536] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00640000 .text C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[1748] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe .text C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe[1748] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001A0000 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001A0F83 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001A0078 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001A0051 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001A0F9E .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001A0036 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001A0F4B .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001A0093 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001A0F1F .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001A00AE .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001A0EFA .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001A0FAF .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001A0FE5 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001A0F68 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001A0FC0 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001A0011 .text C:\WINDOWS\explorer.exe[2056] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001A0F30 .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00290FA8 .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00290F83 .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00290FC3 .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00290FD4 .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00290040 .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00290FEF .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00290025 .text C:\WINDOWS\explorer.exe[2056] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00290014 .text C:\WINDOWS\explorer.exe[2056] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 002C0FEF .text C:\WINDOWS\explorer.exe[2056] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 002C0FD4 .text C:\WINDOWS\explorer.exe[2056] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 002C0FC3 .text C:\WINDOWS\explorer.exe[2056] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 002C0FA8 .text C:\WINDOWS\explorer.exe[2056] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02010FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001A000A .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001A0060 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001A0F61 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001A0F72 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001A0F8D .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001A0FB9 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001A0F2E .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001A0F3F .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001A0EFF .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001A00A2 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001A0EEE .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001A0F9E .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001A0FE5 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001A0F50 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001A0025 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001A0FD4 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001A0087 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00290FA8 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00290F6B .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00290FC3 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00290FDE .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00290028 .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00290FEF .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00290F7C .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ 49, 88 ] .text C:\WINDOWS\SYSTEM32\svchost.exe[2856] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00290F97 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001B0000 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001B0FA1 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001B0FB2 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001B0080 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001B0FC3 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001B0FDE .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001B0F7C .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001B00C2 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001B0F5A .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001B0F6B .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001B010E .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001B0065 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001B0025 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001B00B1 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001B0FEF .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001B0036 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001B00DF .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 002B0FDE .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 002B0065 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 002B0FEF .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 002B0025 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 002B004A .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 002B0000 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 002B0FA8 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ 4B, 88 ] .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 002B0FC3 .text C:\WINDOWS\SYSTEM32\wuauclt.exe[3532] WS2_32.dll!socket 71AB4211 5 Bytes JMP 003D0FEF .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + FFFFCF9D 76BF10ED 37 Bytes [ 00, 8D, 7E, 64, EB, 8C, F6, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + FFFFCFC3 76BF1113 16 Bytes [ EB, 24, 90, 90, 90, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + FFFFCFD4 76BF1124 125 Bytes [ 53, 56, 8B, F1, 57, 8D, 5E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + FFFFD0B3 76BF1203 15 Bytes CALL 76BD7996 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + FFFFD0C3 76BF1213 80 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameA + B 76BF1485 82 Bytes [ 00, 89, 32, C7, 42, 20, 01, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameA + 5E 76BF14D8 22 Bytes [ 00, C9, C2, 08, 00, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameA + 76 76BF14F0 77 Bytes [ 04, 75, 38, 57, 8B, 79, 04, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameA + C5 76BF153F 3 Bytes [ 74, 02, 02 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameA + C9 76BF1543 77 Bytes [ 56, 8B, 75, 14, 57, 56, E8, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumDeviceDrivers + 15 76BF1650 1 Byte [ 7D ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumDeviceDrivers + 17 76BF1652 74 Bytes [ 83, 4F, 70, 10, 8B, 45, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumDeviceDrivers + 62 76BF169D 24 Bytes CALL 76BF16BE C:\WINDOWS\system32\PSAPI.DLL .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumDeviceDrivers + 7D 76BF16B8 23 Bytes JMP 074FA734 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumDeviceDrivers + 95 76BF16D0 19 Bytes [ FF, 55, 8B, EC, 8B, 45, 0C, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExW + 4 76BF176E 144 Bytes [ 45, 14, 0F, 85, 91, FF, 01, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExW + 95 76BF17FF 36 Bytes [ 57, FF, 75, 14, 89, 4E, 60, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExW + BA 76BF1824 133 Bytes CALL 76BF14A6 C:\WINDOWS\system32\PSAPI.DLL .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExW + 140 76BF18AA 72 Bytes [ EC, 8B, 4D, 08, 80, B9, E5, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExW + 189 76BF18F3 33 Bytes JMP 76BF1436 C:\WINDOWS\system32\PSAPI.DLL .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverFileNameA + 25 76BF1CEA 93 Bytes [ F3, A5, 8B, CA, 83, E1, 03, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverFileNameW + 8 76BF1D48 51 Bytes [ 4D, 0C, 89, 01, 33, C0, 5F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverFileNameW + 3C 76BF1D7C 12 Bytes [ FF, FF, C7, 45, FC, 0E, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverFileNameW + 49 76BF1D89 24 Bytes JMP 76BF1CFE C:\WINDOWS\system32\PSAPI.DLL .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameW + 6 76BF1DA2 13 Bytes CALL 76BD91C3 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameW + 14 76BF1DB0 18 Bytes [ 35, AC, 10, E7, 77, 8D, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetDeviceDriverBaseNameW + 27 76BF1DC3 62 Bytes [ C0, 0F, 84, 18, 79, 01, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetMappedFileNameW + B 76BF1E03 147 Bytes CALL 76BD76BB .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetMappedFileNameA + 7 76BF1E97 37 Bytes [ 8D, 45, F8, 50, 53, FF, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetMappedFileNameA + 2D 76BF1EBD 67 Bytes CALL 76BD76BD .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcessModules + D 76BF1F01 133 Bytes [ 00, 00, 00, 68, C0, B2, EF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcessModules + 93 76BF1F87 39 Bytes [ 83, F8, FF, 8B, CB, 0F, 84, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcessModules + BD 76BF1FB1 17 Bytes [ 90, 90, 90, 90, 90, 83, 3D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcessModules + CF 76BF1FC3 33 Bytes [ 90, 90, 90, 90, 8B, FF, 55, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcessModules + F1 76BF1FE5 21 Bytes [ 45, 08, 39, 05, 60, B3, EF, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExA + 11 76BF205E 14 Bytes [ 88, 7C, 8B, 70, 04, E9, 87, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExA + 20 76BF206D 28 Bytes JMP 76BE289E .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExA + 3D 76BF208A 23 Bytes [ 6A, 01, 8D, 85, D8, FD, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleFileNameExA + 55 76BF20A2 41 Bytes JMP 76C0EA35 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleBaseNameW + 17 76BF20CC 31 Bytes [ 75, 10, FF, 75, 14, FF, 15, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleBaseNameW + 37 76BF20EC 64 Bytes [ FF, 90, 90, 90, 90, 90, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleBaseNameW + 78 76BF212D 103 Bytes [ 6A, 00, FF, B6, A8, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleBaseNameA + 63 76BF2195 75 Bytes CALL 76BE2D0E .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleInformation + 47 76BF21E1 74 Bytes [ EC, 53, 56, 8B, 75, 10, 57, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetModuleInformation + 92 76BF222C 130 Bytes [ 05, A4, 50, 88, 7C, E9, B3, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!QueryWorkingSet + B 76BF22AF 59 Bytes [ FF, 90, 90, 90, 90, 90, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!QueryWorkingSet + 47 76BF22EB 187 Bytes [ 51, 8D, 45, 08, 50, FF, 76, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!QueryWorkingSet + 103 76BF23A7 174 Bytes CALL 3E74A8BB .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!QueryWorkingSet + 1B2 76BF2456 32 Bytes [ FF, 8B, F8, 85, FF, 0F, 8C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!QueryWorkingSet + 1D3 76BF2477 14 Bytes [ 83, 3E, 03, 0F, 84, 03, 69, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcesses + A1 76BF3B17 59 Bytes CALL 76BF438B C:\WINDOWS\system32\PSAPI.DLL .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcesses + DD 76BF3B53 2 Bytes [ 8B, 75 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcesses + E0 76BF3B56 5 Bytes [ 85, C0, 74, 03, 50 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcesses + E6 76BF3B5C 83 Bytes [ 08, 83, 7D, E4, 00, 74, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumProcesses + 13A 76BF3BB0 40 Bytes [ C2, 14, 00, 90, 90, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetProcessMemoryInfo + 1C 76BF3BD9 201 Bytes [ F9, 0C, 73, 08, 8D, 45, D4, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetProcessMemoryInfo + E6 76BF3CA3 28 Bytes [ C3, 90, 90, 90, 90, 90, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!InitializeProcessForWsWatch + 10 76BF3CC1 5 Bytes [ 4C, 11, DD, 77, 33 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!InitializeProcessForWsWatch + 16 76BF3CC7 12 Bytes [ EB, 03, 33, C0, 40, E8, BE, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!InitializeProcessForWsWatch + 23 76BF3CD4 4 Bytes [ 90, 90, 90, 90 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!InitializeProcessForWsWatch + 28 76BF3CD9 61 Bytes [ FF, FF, FF, 93, 7C, E3, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetWsChanges + 22 76BF3D17 18 Bytes CALL 76BAD871 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetWsChanges + 35 76BF3D2A 6 Bytes [ FF, 75, E4, E8, 22, EC ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetProcessImageFileNameW + 2 76BF3D31 61 Bytes [ FF, 83, 4D, FC, FF, 85, C0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetProcessImageFileNameW + 40 76BF3D6F 135 Bytes [ 75, 1C, FF, 75, 18, FF, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetProcessImageFileNameA + 3A 76BF3DF7 2 Bytes [ 75, 07 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetProcessImageFileNameA + 3D 76BF3DFA 131 Bytes [ 45, E4, 08, 00, 00, 00, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetPerformanceInfo + 3D 76BF3E7E 10 Bytes CALL 76B9298C .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetPerformanceInfo + 48 76BF3E89 9 Bytes [ 90, 90, 90, 90, 90, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetPerformanceInfo + 52 76BF3E93 39 Bytes [ FF, 0B, 7E, E3, 77, 1E, 7E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetPerformanceInfo + 7A 76BF3EBB 32 Bytes [ 8D, 45, 94, 50, 6A, 64, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!GetPerformanceInfo + 9B 76BF3EDC 46 Bytes [ C9, C2, 04, 00, 90, 90, 90, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesW + 41 76BF4022 4 Bytes [ 00, 68, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesW + 47 76BF4028 27 Bytes [ 04, 00, 0C, 00, 30, E8, 04, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesW + 63 76BF4044 17 Bytes [ 03, 00, 18, 01, 04, 00, 40, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesW + 77 76BF4058 8 Bytes [ 05, 00, 10, 00, 32, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesW + 80 76BF4061 87 Bytes [ 00, 08, 00, 46, 03, 08, 01, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + E4 76BF4234 51 Bytes [ 64, 00, 73, 00, 41, 00, 64, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + 118 76BF4268 19 Bytes [ 72, 00, 69, 00, 63, 00, 74, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + 12C 76BF427C 79 Bytes [ 69, 00, 64, 00, 73, 00, 54, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + 17C 76BF42CC 1 Byte [ 61 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] PSAPI.DLL!EnumPageFilesA + 17E 76BF42CE 7 Bytes [ 78, 00, 50, 00, 72, 00, 69 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + FFF66A1B 3D931671 159 Bytes [ 39, 5D, 08, 0F, 85, 87, DB, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + FFF66ABB 3D931711 28 Bytes [ 00, 00, 89, 45, D8, 89, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + FFF66AD8 3D93172E 101 Bytes [ D4, 18, 00, 00, 00, C7, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + FFF66B3E 3D931794 28 Bytes [ FC, FF, 15, 28, 14, DD, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + FFF66B5B 3D9317B1 32 Bytes [ 15, 94, 14, DD, 77, 85, DB, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlW + 4 3D9340C4 72 Bytes [ 45, F8, 8B, 75, 10, 8D, 7C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlW + 4E 3D93410E 14 Bytes [ F0, 39, 5D, F0, 74, 46, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlW + 5D 3D93411D 20 Bytes CALL 3D933D85 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlW + 72 3D934132 10 Bytes [ 15, 70, 14, F6, 77, 8B, 7D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlW + 7D 3D93413D 54 Bytes [ 02, 8B, C8, 8B, D1, C1, E9, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoA + 9 3D934F17 53 Bytes [ 50, 8D, 85, FC, F5, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoA + 3F 3D934F4D 50 Bytes [ FF, 75, 10, 89, 45, E8, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoA + 72 3D934F80 102 Bytes [ 8B, 45, 08, 89, 46, 10, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoA + D9 3D934FE7 23 Bytes CALL 3D934F6E C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoA + F1 3D934FFF 4 Bytes [ FF, 02, 0D, 02 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheHeaderData + 12 3D93526B 33 Bytes [ 00, 00, 00, 00, 00, 06, 06, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheHeaderData + 34 3D93528D 14 Bytes [ 00, 00, 00, 14, 2C, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheHeaderData + 43 3D93529C 2 Bytes [ 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheHeaderData + 48 3D9352A1 7 Bytes [ 00, 00, 00, 2C, 2C, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheHeaderData + 50 3D9352A9 26 Bytes [ 00, 00, 00, 06, 06, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExW + 22 3D93BE65 20 Bytes [ 00, 8D, BE, 90, 09, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExW + 37 3D93BE7A 45 Bytes [ 00, 8B, 4E, 04, 8B, 01, 68, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExW + 65 3D93BEA8 66 Bytes [ 50, 60, 8B, 86, 88, 09, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExW + A8 3D93BEEB 134 Bytes [ 66, 89, 5E, 20, 8B, 01, 57, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExW + 12F 3D93BF72 17 Bytes [ 52, 8D, 95, CC, FD, FF, FF, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlW + A1 3D93CA47 57 Bytes [ 83, C0, 03, 83, E0, FC, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlW + DB 3D93CA81 21 Bytes [ 55, 8B, EC, 51, 51, 53, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlW + F1 3D93CA97 9 Bytes [ 66, 83, 3F, 5C, 59, 74, 35, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlW + FB 3D93CAA1 64 Bytes [ 0E, 83, C0, 03, 83, E0, FC, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlW + 13C 3D93CAE2 41 Bytes CALL 3D8FB417 .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionA + 36 3D94007F 5 Bytes [ 75, 14, 56, E8, 15 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionA + 3D 3D940086 40 Bytes [ FF, 3B, C7, 89, 03, 74, 09, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionA + 66 3D9400AF 17 Bytes [ A1, AC, B2, EF, 77, 89, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionA + 78 3D9400C1 55 Bytes [ 77, 89, 45, 94, 8B, 45, 14, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionA + B0 3D9400F9 31 Bytes [ 4E, 2F, FB, FF, 3B, C3, 89, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateExW + 29 3D94070B 5 Bytes [ 55, 8B, EC, 56, 57 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateExW + 2F 3D940711 30 Bytes [ 75, 08, 8B, F1, 8B, 46, 64, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateExW + 4E 3D940730 43 Bytes [ 6A, 5A, 57, 6A, 03, E8, 32, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateExW + 7A 3D94075C 40 Bytes [ 22, 03, 09, 80, 74, 2E, 81, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateExW + A5 3D940787 103 Bytes [ 05, 21, 07, 00, 00, 8B, F0, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedState + 26 3D9408CD 24 Bytes [ 46, 64, 8D, 4D, FC, 51, 57, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedState + 3F 3D9408E6 21 Bytes [ BE, E5, 06, 00, 00, 56, 6A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedState + 55 3D9408FC 276 Bytes [ 01, 00, 00, 00, EB, 06, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedState + 16B 3D940A12 1 Byte [ 08 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedState + 16D 3D940A14 97 Bytes CALL 3D935EA5 C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCanonicalizeUrlW + 4 3D940DFC 121 Bytes [ 46, 08, 85, C0, 74, 1E, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoW + 26 3D940E76 29 Bytes [ 46, 08, 85, C0, 74, 0B, 50, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoW + 44 3D940E94 41 Bytes [ 83, 66, 10, 00, 59, 56, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoW + 6E 3D940EBE 33 Bytes [ FC, 75, 07, 33, C0, E9, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoW + 90 3D940EE0 71 Bytes [ 13, 74, 40, 8B, 43, 04, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoW + D8 3D940F28 48 Bytes [ 39, 8B, 4B, 0C, 85, C9, 74, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryA + 4 3D940F7C 28 Bytes [ 75, FC, 59, 89, 46, 10, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryA + 21 3D940F99 3 Bytes [ 02, 8B, F8 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryA + 25 3D940F9D 9 Bytes JMP C93A02A4 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryA + 2F 3D940FA7 21 Bytes [ FC, 83, E1, 03, F3, A4, 5F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryA + 45 3D940FBD 1 Byte [ EC ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionA + B 3D94330D 66 Bytes [ 47, 47, 66, 8B, 07, 66, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionA + 4E 3D943350 92 Bytes [ 00, 83, F8, 0A, 7D, 24, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionA + AB 3D9433AD 19 Bytes [ 4D, EC, 85, C9, 0F, 85, 7D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionA + BF 3D9433C1 32 Bytes [ 80, 66, 39, F7, 80, 7D, 13, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionA + E0 3D9433E2 98 Bytes [ 8B, 5E, 14, 57, FF, 75, 0C, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionW + 2E 3D9434AE 12 Bytes [ 8B, C2, 83, E0, 07, 56, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionW + 3B 3D9434BB 5 Bytes [ 45, EC, 8B, 46, 1C ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionW + 41 3D9434C1 5 Bytes [ 5D, F0, 83, C3, 04 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionW + 47 3D9434C7 25 Bytes [ 45, DC, 89, 56, 1C, 66, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionW + 61 3D9434E1 73 Bytes [ 00, 83, 65, F8, 00, 8B, 46, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetLockRequestFile + 30 3D9463A6 2 Bytes [ FF, 55 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetLockRequestFile + 33 3D9463A9 10 Bytes [ EC, 8B, 45, 0C, 83, 20, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetLockRequestFile + 3E 3D9463B4 70 Bytes [ 80, 5D, C2, 08, 00, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetLockRequestFile + 85 3D9463FB 62 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetLockRequestFile + C4 3D94643A 4 Bytes [ 88, B8, 00, 00 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFile + 73 3D9465BE 24 Bytes [ 75, 08, 6A, 00, FF, 73, 10, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFile + 8C 3D9465D7 80 Bytes [ 15, 88, 14, F6, 77, EB, 07, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFile + DD 3D946628 62 Bytes [ 96, F6, 77, C7, 46, 04, 30, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFile + 11C 3D946667 158 Bytes [ 8D, 7D, F0, AB, AB, AB, AB, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFile + 1BB 3D946706 5 Bytes [ 07, 80, EB, 10, 50 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionW + 59 3D947854 24 Bytes [ C0, 7C, 1B, 8B, 76, 34, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionW + 73 3D94786E 117 Bytes [ 8B, 00, EB, 02, 33, C0, 5F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionW + E9 3D9478E4 9 Bytes [ 8B, CF, 89, 46, 1C, E8, 16, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionW + F3 3D9478EE 117 Bytes [ 85, C0, 5E, 7C, 0E, FF, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryOptionW + 169 3D947964 21 Bytes [ 75, F8, 89, 46, 18, 8B, 45, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoA + 28 3D9487B5 3 Bytes CALL 3C94893C .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoA + 2C 3D9487B9 5 Bytes [ FF, B5, D4, FE, FF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoA + 32 3D9487BF 44 Bytes CALL 3D98C0F5 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoA + 5F 3D9487EC 89 Bytes [ 35, BC, 14, 93, 3D, 57, 6A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoA + B9 3D948846 11 Bytes [ F0, 2B, 05, F8, 12, 9E, 3D, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCloseHandle + 1E 3D9490A6 11 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCloseHandle + 2A 3D9490B2 22 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCloseHandle + 42 3D9490CA 7 Bytes [ 00, 00, 00, 00, 00, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCloseHandle + 4B 3D9490D3 5 Bytes [ 00, 00, 00, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCloseHandle + 51 3D9490D9 22 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoW + 1D 3D94BDB1 148 Bytes CALL 40992606 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoW + B2 3D94BE46 140 Bytes CALL 3D948462 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoW + 13F 3D94BED3 97 Bytes [ 85, C9, 7E, 2B, 8B, 54, 8F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoW + 1A1 3D94BF35 4 Bytes [ FF, B8, FF, FF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpQueryInfoW + 1A6 3D94BF3A 43 Bytes [ 00, 23, C8, 74, 0E, 3B, C8, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryDataAvailable + 28 3D94BFA7 15 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryDataAvailable + 39 3D94BFB8 28 Bytes CALL 3D94B627 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryDataAvailable + 56 3D94BFD5 6 Bytes [ 8B, CE, E8, FC, E4, FF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryDataAvailable + 5D 3D94BFDC 9 Bytes CALL 3D94A466 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetQueryDataAvailable + 67 3D94BFE6 39 Bytes [ 45, F0, 3B, 45, F8, 0F, 8D, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetUnlockRequestFile + B 3D94CB01 94 Bytes [ 10, F6, 77, 74, 09, 50, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetUnlockRequestFile + 6A 3D94CB60 109 Bytes [ 75, 10, 3B, F7, 0F, 85, 92, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetUnlockRequestFile + D8 3D94CBCE 7 Bytes [ 00, FF, 75, 08, 68, 00, 01 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetUnlockRequestFile + E0 3D94CBD6 32 Bytes CALL 3D948981 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetUnlockRequestFile + 101 3D94CBF7 37 Bytes [ 00, 8B, 45, F4, 8B, 00, 3B, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersA + 27 3D94CF6D 55 Bytes [ 8D, 48, 08, 39, 19, 0F, 84, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersA + 5F 3D94CFA5 1 Byte [ 4D ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersA + 61 3D94CFA7 30 Bytes [ 56, 8B, 75, 14, 85, F6, 89, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersA + 81 3D94CFC7 103 Bytes [ BA, 34, 90, F6, 77, 75, 05, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersA + E9 3D94D02F 26 Bytes [ 3F, C0, 00, 00, 3F, C0, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestA + 63 3D94D56B 103 Bytes [ 01, 01, 01, 01, 01, 52, 55, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestA + CB 3D94D5D3 1 Byte [ 1A ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestA + CD 3D94D5D5 51 Bytes [ 00, 00, 00, 00, 00, 7F, 93, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestA + 101 3D94D609 11 Bytes [ 7C, 56, 15, 0F, 0F, 13, 1A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestA + 10D 3D94D615 2 Bytes [ 00, 00 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectA + 8 3D94DEB6 65 Bytes [ FF, 04, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectA + 4A 3D94DEF8 43 Bytes [ F8, F9, F9, FF, F8, F9, F9, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectA + 76 3D94DF24 47 Bytes [ E5, E6, E6, FF, 01, 01, 01, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectA + A6 3D94DF54 11 Bytes [ FA, FB, FB, FF, FA, FA, FA, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectA + B2 3D94DF60 63 Bytes [ F9, FA, FA, FF, F9, FA, FA, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlA + 11 3D94F339 71 Bytes [ 15, C8, 14, 93, 3D, 8B, 4D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlA + 5A 3D94F382 194 Bytes [ EB, BA, 90, 90, 90, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlA + 11D 3D94F445 16 Bytes [ 74, 09, FF, 75, FC, FF, 15, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlA + 12E 3D94F456 101 Bytes [ 15, C8, 14, 93, 3D, 8B, C7, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCreateUrlA + 194 3D94F4BC 24 Bytes [ C7, 5F, 5E, C9, C2, 0C, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectW + 66 3D94F8C8 86 Bytes [ 55, 8B, EC, 83, 7D, 18, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectW + BD 3D94F91F 27 Bytes [ 8B, F0, 8B, C6, 5E, 5D, C2, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectW + D9 3D94F93B 106 Bytes [ 4D, 0C, 85, D2, 74, 0B, 3C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectW + 144 3D94F9A6 1 Byte [ 75 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConnectW + 146 3D94F9A8 69 Bytes [ 6A, 3A, 56, FF, 15, 7C, 11, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestW + 13 3D94FAD1 42 Bytes [ 3C, 39, 7F, 08, 0F, BE, C0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestW + 3E 3D94FAFC 68 Bytes CALL 3D8F698D .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestW + 84 3D94FB42 29 Bytes [ 60, 8B, C6, 5E, 5D, C2, 14, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestW + A2 3D94FB60 103 Bytes [ EC, 83, 7D, 08, 00, 74, 07, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestW + 10A 3D94FBC8 10 Bytes [ FF, 55, 8B, EC, 56, 8B, F1, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestW + 1C 3D94FC17 91 Bytes [ 45, 10, 0F, 85, 85, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestW + 78 3D94FC73 38 Bytes [ F7, 74, 0D, 39, 7E, 60, 74, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestW + 9F 3D94FC9A 101 Bytes CALL 3D907D2C .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestW + 105 3D94FD00 42 Bytes [ 90, 8B, FF, 55, 8B, EC, 81, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpOpenRequestW + 130 3D94FD2B 2 Bytes [ 7D, 08 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersW + 14 3D94FE5D 56 Bytes [ 45, B8, EB, 34, 39, 7D, BC, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersW + 4D 3D94FE96 51 Bytes [ 45, 10, 8B, 45, 10, 83, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersW + 81 3D94FECA 107 Bytes [ C4, 0C, 39, 7D, 0C, 74, 38, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersW + ED 3D94FF36 39 Bytes [ EB, 28, C7, 45, FC, EB, 2E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpAddRequestHeadersW + 115 3D94FF5E 71 Bytes [ FA, FF, 5B, 39, 7D, EC, 74, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetInitializeAutoProxyDll 3D9514D8 103 Bytes [ 90, 90, 8B, FF, 55, 8B, EC, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetInitializeAutoProxyDll + 68 3D951540 44 Bytes [ 5D, E4, 83, 7D, 10, 09, 7C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetInitializeAutoProxyDll + 95 3D95156D 18 Bytes [ 8B, F0, 89, 75, D0, EB, 3E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetInitializeAutoProxyDll + A8 3D951580 144 Bytes CALL 3D92986D .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetInitializeAutoProxyDll + 139 3D951611 43 Bytes [ 75, CC, FF, 15, 70, 16, DD, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlA + 4D 3D954975 28 Bytes CALL 3D93F751 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlA + 6A 3D954992 26 Bytes [ 55, 8B, EC, 56, 8D, 45, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlA + 85 3D9549AD 75 Bytes [ F6, 0F, 8D, F9, CF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlA + D1 3D9549F9 18 Bytes CALL 3D93D020 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCrackUrlA + E4 3D954A0C 5 Bytes [ 90, 90, 90, 90, 90 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ReadUrlCacheEntryStream + 1A 3D95632D 131 Bytes JMP 3D955E37 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamA + 6B 3D9563B1 2 Bytes [ 22, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamA + 70 3D9563B6 147 Bytes [ 35, 44, 11, DD, 77, 68, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamA + 104 3D95644A 103 Bytes [ FF, 85, C0, 0F, 84, 8A, DD, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamA + 16C 3D9564B2 44 Bytes [ 00, 00, A1, 40, 66, E4, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamA + 199 3D9564DF 45 Bytes [ 68, A0, 97, DD, 77, 8D, 4D, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryA + 9D 3D95680C 37 Bytes [ FF, 3B, C6, 89, B5, E8, FD, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryA + C3 3D956832 47 Bytes [ C9, C2, 04, 00, 90, 90, 53, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryA + F3 3D956862 5 Bytes [ 6E, 00, 64, 00, 6F ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryA + F9 3D956868 29 Bytes [ 77, 00, 73, 00, 20, 00, 4E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryA + 117 3D956886 3 Bytes [ 72, 00, 73 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryFileW + 1A 3D958BF0 7 Bytes [ 00, 00, 00, 00, 00, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryFileW + 23 3D958BF9 36 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryFileW + 48 3D958C1E 12 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryFileW + 56 3D958C2C 22 Bytes [ 30, 00, 00, 80, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryFileW + 6E 3D958C44 12 Bytes [ 48, 00, 00, 00, 60, C0, 08, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryFileW + 22 3D958CB6 8 Bytes [ 00, 00, 00, 00, 00, 00, 04, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryFileW + 2C 3D958CC0 7 Bytes [ 01, 00, 53, 00, 74, 00, 72 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryFileW + 34 3D958CC8 1 Byte [ 69 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryFileW + 36 3D958CCA 7 Bytes [ 6E, 00, 67, 00, 46, 00, 69 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryFileW + 3E 3D958CD2 37 Bytes [ 6C, 00, 65, 00, 49, 00, 6E, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateEx + B 3D958F8C 20 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateEx + 20 3D958FA1 1 Byte [ 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateEx + 23 3D958FA4 30 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateEx + 43 3D958FC4 27 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetConnectedStateEx + 5F 3D958FE0 22 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryA 3D959294 37 Bytes [ 49, 6E, 74, 65, 72, 6E, 65, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryA + 29 3D9592BD 6 Bytes [ 8B, FF, 55, 8B, EC, 51 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExA + 6 3D9592C4 62 Bytes [ 53, 56, 57, FF, 75, 08, 33, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExA + 45 3D959303 29 Bytes [ 15, B8, 14, 93, 3D, 89, 7E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExA + 63 3D959321 38 Bytes [ C0, 74, C3, 8B, 5D, 0C, 3B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExA + 8A 3D959348 1 Byte [ 56 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExA + 8C 3D95934A 12 Bytes [ C7, 46, 44, 01, 00, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExA + 3C 3D959886 87 Bytes [ D1, F8, 03, C0, 50, 8D, 81, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExA + 94 3D9598DE 67 Bytes [ FF, D6, EB, 06, 8B, BD, 6C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExA + D8 3D959922 43 Bytes [ F3, 77, 00, 00, 8B, F8, 3B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExA + 104 3D95994E 123 Bytes [ 00, 3B, C3, 89, 85, 70, FD, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExA + 180 3D9599CA 41 Bytes [ 05, 00, 00, 8B, C7, 8D, 50, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryFile + 2D 3D95A61E 9 Bytes [ F3, AB, 59, C7, 85, FC, FB, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryFile + 37 3D95A628 52 Bytes [ 04, 00, 00, C7, 85, 28, FC, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ReadUrlCacheEntryStreamEx + 1F 3D95A65D 10 Bytes [ FF, 8B, C1, 66, A5, 8B, B5, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ReadUrlCacheEntryStreamEx + 2A 3D95A668 34 Bytes JMP D053336F .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ReadUrlCacheEntryStreamEx + 4D 3D95A68B 15 Bytes [ 85, C0, 75, 21, 8B, 85, 04, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ReadUrlCacheEntryStreamEx + 5D 3D95A69B 4 Bytes [ 85, 08, FC, FF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ReadUrlCacheEntryStreamEx + 62 3D95A6A0 43 Bytes [ A3, CC, 8C, E4, 77, 8B, 85, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryStream + 1E 3D95A6EF 40 Bytes [ FF, 78, 00, 00, 00, C7, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryStream + 47 3D95A718 7 Bytes JMP D053341F .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryStream + 4F 3D95A720 9 Bytes [ FF, F3, A5, 8B, C8, 8D, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryStream + 59 3D95A72A 125 Bytes [ FF, 50, 53, 8D, 85, C0, F7, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UnlockUrlCacheEntryStream + D7 3D95A7A8 11 Bytes [ 67, 00, 54, 00, 72, 00, 61, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTime + A 3D95AC73 166 Bytes [ 6A, 0C, 68, 68, 05, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTime + B1 3D95AD1A 37 Bytes [ 00, 81, 7D, 08, 50, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTime + D7 3D95AD40 31 Bytes [ 00, 00, 53, 89, 5D, F8, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTime + F7 3D95AD60 48 Bytes [ 50, FF, 75, 18, 8D, 45, EC, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTime + 128 3D95AD91 11 Bytes [ 6A, 0D, 68, D3, 05, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenA + 1A 3D95D6AA 23 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenA + 32 3D95D6C2 7 Bytes [ 00, 00, 00, 00, 00, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenA + 3A 3D95D6CA 8 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenA + 43 3D95D6D3 3 Bytes [ 00, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenA + 48 3D95D6D8 32 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenW + 4E 3D95DB57 24 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenW + 69 3D95DB72 23 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenW + 83 3D95DB8C 21 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenW + 99 3D95DBA2 1 Byte [ 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenW + 9C 3D95DBA5 17 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetStatusCallback + 7 3D95DCCF 8 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetStatusCallback + 12 3D95DCDA 3 Bytes [ 00, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetStatusCallback + 16 3D95DCDE 34 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetStatusCallback + 39 3D95DD01 8 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetStatusCallback + 42 3D95DD0A 37 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestA + 37 3D95EEC0 115 Bytes [ 80, 22, E0, 77, 96, 22, E0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestA + AB 3D95EF34 20 Bytes [ 5D, 23, E0, 77, 73, 23, E0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestA + C9 3D95EF52 1 Byte [ 8D ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestA + CB 3D95EF54 44 Bytes [ 04, 83, C0, 04, 50, 68, 5A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestA + F8 3D95EF81 41 Bytes [ 00, 00, 00, 10, 24, DE, 77, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlA + 25 3D95F3C9 22 Bytes [ 69, 04, 33, C2, 23, C7, 33, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlA + 3C 3D95F3E0 514 Bytes [ 69, 18, 03, DA, 33, C3, 23, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlA + 23F 3D95F5E3 79 Bytes [ 69, 1C, 03, F5, 03, FB, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlA + 28F 3D95F633 37 Bytes [ C3, 03, FD, 05, FA, 27, A1, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlA + 2B5 3D95F659 8 Bytes [ C7, 03, F7, 8B, 69, 18, 03, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerW + 27 3D960977 113 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerW + 99 3D9609E9 79 Bytes CALL 3D96BE60 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerW + E9 3D960A39 13 Bytes [ B8, E6, 06, 00, 00, EB, 3D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerW + F7 3D960A47 95 Bytes [ 30, 33, C0, 66, 8B, 86, F4, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerW + 157 3D960AA7 51 Bytes [ F8, 85, FF, 74, 06, 56, E8, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCombineUrlW 3D960AF5 3 Bytes [ 90, 90, 90 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCombineUrlW + 4 3D960AF9 42 Bytes [ FF, 55, 8B, EC, 56, 57, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCombineUrlW + 30 3D960B25 250 Bytes [ 05, 6A, 0E, 58, EB, 18, 57, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCombineUrlW + 12B 3D960C20 27 Bytes [ 35, 8C, BD, EF, 77, FF, 15, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCombineUrlW + 147 3D960C3C 38 Bytes CALL 3D95E08E C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryInfoA + 1A 3D962475 90 Bytes [ 83, C4, 10, 33, C0, E9, E7, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryInfoA + 75 3D9624D0 56 Bytes [ 51, 75, 65, 72, 79, 53, 79, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryInfoA + AE 3D962509 23 Bytes [ 8B, F8, 56, FF, 15, 58, 13, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryInfoA + C6 3D962521 13 Bytes [ 83, 7E, 18, 00, 0F, 84, 0F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryInfoA + D4 3D96252F 114 Bytes CALL 3D938268 C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheContainerA + 2 3D962DA1 25 Bytes [ 75, F4, FF, 15, 58, 13, E7, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheContainerA + 1C 3D962DBB 93 Bytes CALL 3D973290 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerA + 39 3D962E19 94 Bytes JMP 3D936371 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerA + 98 3D962E78 31 Bytes JMP 3D947383 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerA + B8 3D962E98 30 Bytes [ 0E, 8B, 01, 56, FF, 50, 3C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerA + D8 3D962EB8 19 Bytes JMP 3D94A42E C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheContainerA + EC 3D962ECC 8 Bytes JMP 3D950E32 C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryW + F7 3D96317C 44 Bytes JMP 3D95BC30 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryW + 124 3D9631A9 88 Bytes [ 00, 00, 8B, 41, 5C, E9, 69, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryW + 17D 3D963202 23 Bytes [ 15, 84, 11, E7, 77, E9, 7F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryW + 195 3D96321A 1 Byte [ 85 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CommitUrlCacheEntryW + 197 3D96321C 45 Bytes [ 75, 09, B8, A5, 06, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExW + E 3D963357 13 Bytes [ 17, FF, 71, 54, BF, 1A, 07, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExW + 1C 3D963365 5 Bytes [ 50, 56, 68, 5E, 01 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExW + 23 3D96336C 124 Bytes [ 57, EB, 13, 68, A0, BB, 0D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExA + 68 3D9633E9 55 Bytes [ 85, C0, 74, 33, 8B, 4D, 1C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExA + A0 3D963421 33 Bytes [ 4D, F8, 51, 8B, CF, E8, 26, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExA + C2 3D963443 61 Bytes JMP 3D94E294 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExA + 100 3D963481 97 Bytes JMP 3D960467 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetReadFileExA + 162 3D9634E3 78 Bytes [ 17, 03, 09, 80, 74, 0F, 3D, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieExW + A9 3D964B7A 1 Byte [ E0 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieExW + AB 3D964B7C 87 Bytes [ 15, E4, 11, DD, 77, E9, 6C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieExA + 4 3D964BD4 151 Bytes [ 48, 04, 39, 08, 74, 0C, 51, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieExA + 9C 3D964C6C 1 Byte [ F6 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieExA + 9F 3D964C6F 3 Bytes [ 99, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieExA + A3 3D964C73 33 Bytes [ 83, FF, 0F, 77, 35, 8D, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieExA + C5 3D964C95 24 Bytes [ 17, 57, 8D, 45, DC, 56, 50, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieExW + 43 3D965FC8 96 Bytes [ 70, 78, FF, 15, C4, 11, 41, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieExW + A4 3D966029 305 Bytes [ 47, 65, 74, 50, 69, 78, 65, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieExW + 1D6 3D96615B 35 Bytes [ 47, 65, 74, 54, 65, 78, 74, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieExW + 1FA 3D96617F 98 Bytes [ 78, 50, 6F, 69, 6E, 74, 49, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieExW + 25D 3D9661E2 7 Bytes [ 47, 65, 74, 54, 65, 78, 74 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsUrlCacheEntryExpiredW + 56 3D9663C6 57 Bytes [ 56, 69, 65, 77, 70, 6F, 72, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsUrlCacheEntryExpiredW + 90 3D966400 105 Bytes [ 6D, 43, 6C, 69, 70, 4C, 69, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsUrlCacheEntryExpiredW + FA 3D96646A 3 Bytes [ 50, 69, 65 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsUrlCacheEntryExpiredW + FE 3D96646E 4 Bytes [ 50, 6C, 61, 79 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsUrlCacheEntryExpiredW + 103 3D966473 10 Bytes [ 6E, 68, 4D, 65, 74, 61, 46, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IncrementUrlCacheHeaderData + 23 3D967212 32 Bytes [ 89, 41, 1C, 8B, 82, 88, 01, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IncrementUrlCacheHeaderData + 44 3D967233 24 Bytes [ 00, 0F, B7, 01, 83, C0, 03, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IncrementUrlCacheHeaderData + 5D 3D96724C 126 Bytes [ 36, 3B, 35, 0C, 40, F5, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IncrementUrlCacheHeaderData + DC 3D9672CB 1 Byte [ 56 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IncrementUrlCacheHeaderData + DE 3D9672CD 101 Bytes [ D8, FF, 15, B0, 11, F1, 77, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsHostInProxyBypassList + 4 3D967A3D 62 Bytes [ 4D, 0C, 85, C9, 74, 19, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsHostInProxyBypassList + 43 3D967A7C 71 Bytes [ DA, 57, 89, 55, F8, 0F, 84, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsHostInProxyBypassList + 8C 3D967AC5 20 Bytes CALL 3D967B4D C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsHostInProxyBypassList + A2 3D967ADB 3 Bytes [ A1, 8B, 01 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsHostInProxyBypassList + A6 3D967ADF 20 Bytes [ 83, 7D, 0C, 02, 0F, 84, A3, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheEntry + 46 3D967D80 81 Bytes [ FF, FF, FF, FF, AB, 2C, F3, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheEntry + 98 3D967DD2 131 Bytes [ FF, 33, F6, 89, 30, 33, C0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheEntry + 11C 3D967E56 15 Bytes [ BD, A4, FD, FF, FF, 89, BD, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheEntry + 12C 3D967E66 8 Bytes [ 8B, C8, 3B, CF, 89, 8D, A0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheEntry + 135 3D967E6F 28 Bytes [ FF, 74, 1A, 83, 39, 28, 72, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossingW + 4 3D968827 13 Bytes [ 85, D4, FC, FF, FF, 03, C0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossingW + 12 3D968835 254 Bytes [ FF, B5, EC, FC, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossingW + 112 3D968935 187 Bytes [ 46, 10, 03, C7, 8B, 08, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossingW + 1CE 3D9689F1 45 Bytes [ 89, 45, FC, 75, 5B, C7, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossingW + 1FD 3D968A20 59 Bytes [ FF, 24, 8D, 53, 05, 96, 3D, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerW + 65 3D9693DA 32 Bytes CALL 3D957461 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerW + 86 3D9693FB 9 Bytes [ 5D, 08, 85, DB, 56, 57, 74, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerW + 90 3D969405 11 Bytes [ 0C, 85, F6, 74, 64, 56, C6, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerW + 9C 3D969411 4 Bytes [ FF, FF, 89, 45 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerW + A1 3D969416 37 Bytes [ 80, 3E, 00, 74, 5F, 56, E8, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryGroupW + 68 3D969699 40 Bytes [ 33, C0, EB, F7, 90, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryGroupW + 91 3D9696C2 16 Bytes CALL 3D95B4A3 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryGroupW + A2 3D9696D3 93 Bytes [ 65, 08, 00, 56, 57, 53, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryGroupW + 100 3D969731 34 Bytes [ FF, 15, 70, 13, F6, 77, 5F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheEntryGroupW + 123 3D969754 31 Bytes [ 00, 00, 68, 0B, 01, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacyGetZonePreferenceW + 7C 3D970EC5 24 Bytes [ 66, 83, 24, 47, 00, E9, 1A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacyGetZonePreferenceW + 95 3D970EDE 11 Bytes [ F6, 45, 0A, 01, 89, 06, 0F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacyGetZonePreferenceW + A1 3D970EEA 71 Bytes [ 53, FF, 15, F0, 10, FE, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacyGetZonePreferenceW + E9 3D970F32 10 Bytes [ D6, FF, 73, 08, 8D, 45, E4, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacyGetZonePreferenceW + F4 3D970F3D 226 Bytes [ 73, 0C, 8D, 45, DC, 50, FF, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerA + 2 3D97260A 17 Bytes [ 51, 8D, 88, E4, 01, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerA + 14 3D97261C 83 Bytes [ 50, 8D, 85, F4, FE, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerA + 68 3D972670 5 Bytes [ 85, C0, 74, 16, 8B ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerA + 6E 3D972676 20 Bytes CALL 79972679 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheContainerA + 84 3D97268C 1 Byte [ F0 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamW + 2 3D972C17 41 Bytes [ 8B, D8, 85, DB, 0F, 85, D1, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamW + 2D 3D972C42 52 Bytes [ 8D, 85, 54, FE, FF, FF, 50, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamW + 62 3D972C77 9 Bytes [ 8D, 74, FE, FF, FF, 89, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamW + 6C 3D972C81 32 Bytes [ FF, 74, 24, 8B, 50, 1C, 51, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!RetrieveUrlCacheEntryStreamW + 8E 3D972CA3 27 Bytes [ FF, 01, 00, 00, 00, F6, 45, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DetectAutoProxyUrl + C 3D976947 232 Bytes [ 00, 66, 3B, C7, 0F, 84, A4, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DetectAutoProxyUrl + F5 3D976A30 19 Bytes [ 00, 5D, C2, 14, 00, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DetectAutoProxyUrl + 10A 3D976A45 81 Bytes [ A1, 88, 61, E4, 77, 53, 89, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DetectAutoProxyUrl + 15C 3D976A97 39 Bytes [ 68, 19, 00, 02, 00, 68, 48, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DetectAutoProxyUrl + 184 3D976ABF 16 Bytes [ 15, D8, 15, DD, 77, 8D, 85, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryW + C 3D979896 3 Bytes [ 00, 00, 24 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryW + 10 3D97989A 3 Bytes [ 00, 00, 5F ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryW + 14 3D97989E 3 Bytes [ 52, 00, 65 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryW + 18 3D9798A2 3 Bytes [ 66, 00, 65 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheEntryW + 1C 3D9798A6 3 Bytes [ 72, 00, 72 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExA + 49 3D983D83 23 Bytes [ 00, 8A, 51, 04, B8, 02, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExA + 61 3D983D9B 10 Bytes [ 0F, 84, 96, 00, 00, 00, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExA + 6C 3D983DA6 105 Bytes [ 00, 8B, BE, 88, 02, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExA + D6 3D983E10 84 Bytes [ 68, 00, 02, 00, 00, 56, 6A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheEntryInfoExA + 12B 3D983E65 315 Bytes [ 4F, 28, F6, C5, 40, 74, 09, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExW + 1 3D9845C4 45 Bytes [ 86, 18, 02, 00, 00, 01, 58, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExW + 30 3D9845F3 90 Bytes [ 8B, 87, 80, 01, 00, 00, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExW + 8B 3D98464E 116 Bytes [ 11, 89, 55, C8, 3B, D3, 0F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExW + 100 3D9846C3 28 Bytes [ 15, F4, 15, DD, 77, 50, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheEntryExW + 11D 3D9846E0 1 Byte [ 75 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetDialW + 4D 3D9A0324 42 Bytes CALL 3D99F0A5 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetDialW + 78 3D9A034F 3 Bytes [ 00, 74, 05 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetDialW + 7C 3D9A0353 12 Bytes CALL 0525DA57 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetDialW + 89 3D9A0360 18 Bytes [ 50, 65, 72, 55, 73, 65, 72, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetDialW + 9C 3D9A0373 45 Bytes [ 55, 8B, EC, 81, EC, 10, 01, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetDial + 39 3D9A080E 67 Bytes [ 00, 00, 3B, C6, A3, E4, 12, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetHangUp + D 3D9A0852 15 Bytes [ FF, 15, D0, 14, 93, 3D, A1, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetHangUp + 1D 3D9A0862 103 Bytes [ FF, 33, C0, EB, A9, 90, 53, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetHangUp + 85 3D9A08CA 53 Bytes [ CE, 89, 46, 24, 89, 46, 28, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetHangUp + BB 3D9A0900 49 Bytes [ 83, CC, FF, FF, 5E, C3, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetHangUp + ED 3D9A0932 7 Bytes [ 85, C0, 0F, 85, 65, F8, 05 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodial + 2B 3D9A096E 29 Bytes [ 85, C0, C7, 45, F4, 60, 86, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodial + 49 3D9A098C 34 Bytes [ 15, 78, 13, 93, 3D, 3B, C3, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodial + 6D 3D9A09B0 16 Bytes [ 89, 46, 10, 39, 1D, C8, 1A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodial + 7F 3D9A09C2 2 Bytes [ CC, 14 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodial + 83 3D9A09C6 25 Bytes [ 8D, 7E, 14, 8B, CF, 89, 5D, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialHangup + 20 3D9A0E01 96 Bytes [ FF, 59, 8B, C8, 85, C9, 0F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialHangup + 81 3D9A0E62 48 Bytes [ 8B, 07, 8B, 8D, F0, FD, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialHangup + B2 3D9A0E93 4 Bytes [ FF, C9, C3, 90 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialHangup + B7 3D9A0E98 37 Bytes [ 01, 00, 00, 00, 00, 00, 10, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialCallback + 22 3D9A0EBE 34 Bytes CALL CB9A0EC0 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialCallback + 45 3D9A0EE1 47 Bytes [ DC, BA, FF, FF, 3B, C3, 89, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialCallback + 75 3D9A0F11 15 Bytes [ B5, EC, FD, FF, FF, 57, 50, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialCallback + 85 3D9A0F21 92 Bytes [ F0, FD, FF, FF, 0F, 8D, C2, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAutodialCallback + E2 3D9A0F7E 58 Bytes JMP 3D9A2DF4 C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGoOnline + 6F 3D9A1283 35 Bytes [ FF, 0F, B7, 4A, 10, E9, 64, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGoOnline + 93 3D9A12A7 90 Bytes JMP 3D9A0C9D C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGoOnline + EE 3D9A1302 18 Bytes [ 6A, FF, 53, 8D, 85, 78, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGoOnline + 101 3D9A1315 126 Bytes JMP 3D9A0DA5 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGoOnline + 182 3D9A1396 22 Bytes CALL 3D99E2BE C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DllInstall + 19 3D9A32E1 43 Bytes [ 00, EB, 04, 83, 65, D8, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DllInstall + 45 3D9A330D 45 Bytes [ 74, 12, 8D, 45, DC, 50, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DllInstall + 73 3D9A333B 66 Bytes [ 12, 10, 02, C0, 33, FF, 47, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DllInstall + B6 3D9A337E 79 Bytes [ 08, 0F, 85, 43, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DllInstall + 107 3D9A33CF 57 Bytes [ A1, 78, BD, EF, 77, 8B, 48, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCanonicalizeUrlA + 4C 3D9A58B6 940 Bytes [ F6, F3, F3, F3, F3, F6, F3, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAttemptConnect + 3F 3D9A5C63 216 Bytes [ 94, 76, 89, 96, 8E, 8E, 8E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAttemptConnect + 118 3D9A5D3C 769 Bytes [ 36, 36, 36, 36, 36, 36, 36, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAttemptConnect + 41B 3D9A603F 67 Bytes [ 8B, 8D, 40, FF, FF, FF, 81, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetSecurityInfoByURL + 36 3D9A6083 15 Bytes [ FF, FF, 73, 44, 33, C0, 8A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetSecurityInfoByURL + 46 3D9A6093 100 Bytes [ 15, CC, 10, F1, 77, 85, C0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetWriteFile + 2 3D9A60F8 36 Bytes [ FF, FF, 15, 58, 51, F5, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetWriteFile + 27 3D9A611D 2 Bytes [ 47, 01 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetWriteFile + 2A 3D9A6120 68 Bytes [ 33, DB, 3B, C3, 89, 85, 58, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetWriteFile + 6F 3D9A6165 43 Bytes [ FF, FF, EB, 10, 6A, 57, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetWriteFile + 9B 3D9A6191 6 Bytes [ FF, FF, 8B, 40, 30, 53 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileA + 4E 3D9A6376 29 Bytes [ 82, 00, 00, 00, 7F, 08, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileA + 6C 3D9A6394 19 Bytes [ 70, 18, FF, 15, A8, 11, F1, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileA + 80 3D9A63A8 27 Bytes [ FF, B5, F4, FE, FF, FF, 6A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileA + 9C 3D9A63C4 48 Bytes [ 50, 56, FF, B5, EC, FE, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileA + CD 3D9A63F5 183 Bytes [ FF, 70, 18, FF, 15, AC, 11, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetShowSecurityInfoByURL + 2 3D9A650A 37 Bytes [ FF, 53, FF, B5, 40, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetShowSecurityInfoByURL + 28 3D9A6530 23 Bytes [ 8B, 8D, 3C, FF, FF, FF, 81, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetShowSecurityInfoByURL + 40 3D9A6548 7 Bytes [ 00, 74, F3, 81, F9, B6, 03 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetShowSecurityInfoByURL + 48 3D9A6550 27 Bytes [ 00, 74, EB, 33, D2, 81, F9, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetShowSecurityInfoByURL + 65 3D9A656D 11 Bytes [ 89, 95, 54, FF, FF, FF, 74, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCheckConnectionA + 4 3D9A6668 35 Bytes [ 85, 50, FF, FF, FF, 89, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCheckConnectionA + 29 3D9A668D 5 Bytes [ 7C, BB, 8D, 85, 5C ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCheckConnectionA + 2F 3D9A6693 5 Bytes [ FF, FF, 39, 85, 58 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCheckConnectionA + 35 3D9A6699 14 Bytes [ FF, FF, 74, 19, 64, A1, 18, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetCheckConnectionA + 45 3D9A66A9 4 Bytes [ 8B, 40, 30, 57 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ForceNexusLookupExW + 7 3D9A6AFA 126 Bytes CALL 3D986A91 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ForceNexusLookup + 42 3D9A6B79 75 Bytes [ CE, C1, E1, 03, 51, 53, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ForceNexusLookup + 8E 3D9A6BC5 62 Bytes [ 45, 10, 8B, 3D, C8, 10, F1, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ForceNexusLookup + D0 3D9A6C07 24 Bytes [ 6A, 01, 8D, 46, FE, 50, 53, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ForceNexusLookup + EA 3D9A6C21 184 Bytes [ 00, 39, 5D, 10, 0F, 84, 86, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateMD5SSOHash + 6D 3D9A6CDD 30 Bytes [ 75, F4, 8B, 40, 30, 53, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateMD5SSOHash + 8C 3D9A6CFC 15 Bytes JMP 3D9BA830 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateMD5SSOHash + 9C 3D9A6D0C 9 Bytes [ 55, 8B, EC, 56, 8B, 75, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateMD5SSOHash + A6 3D9A6D16 11 Bytes CALL 3D9BA86E C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateMD5SSOHash + B2 3D9A6D22 9 Bytes [ 14, 85, F6, 74, 10, 6A, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlW + 6A 3D9A6E49 37 Bytes CALL 3D97F3A1 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlW + 90 3D9A6E6F 35 Bytes [ 15, B0, 11, F1, 77, 5F, EB, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetOpenUrlW + B5 3D9A6E94 24 Bytes [ 8B, FF, 55, 8B, EC, 51, 51, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileW + 4 3D9A6EAD 76 Bytes [ 55, 10, 85, D2, 7E, 6A, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileW + 52 3D9A6EFB 6 Bytes [ 75, 1C, 50, 56, 52, 57 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFindNextFileW + 59 3D9A6F02 267 Bytes [ 75, 08, FF, 15, 58, 51, F5, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetShowSecurityInfoByURLW + 23 3D9A700E 92 Bytes [ 75, 10, FF, 75, 0C, 50, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetSecurityInfoByURLW + 23 3D9A706B 28 Bytes [ FF, FE, 6B, 44, 7E, 07, 6C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetSecurityInfoByURLW + 40 3D9A7088 13 Bytes [ 8D, BE, A4, 00, 00, 00, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetSecurityInfoByURLW + 4E 3D9A7096 23 Bytes CALL 3D9A3235 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetSecurityInfoByURLW + 67 3D9A70AF 115 Bytes [ 20, 33, 45, 10, 83, E0, 70, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetLastResponseInfoW + 56 3D9A7123 70 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetLastResponseInfoW + 9D 3D9A716A 10 Bytes [ 8B, 45, 08, 83, F8, FF, 0F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetLastResponseInfoW + A8 3D9A7175 47 Bytes [ FF, 3D, FF, FF, 00, 00, 0F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetLastResponseInfoW + D9 3D9A71A6 27 Bytes [ 10, 56, 50, 83, E1, 3F, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetLastResponseInfoW + F6 3D9A71C3 1 Byte [ 20 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionExA + 2 3D9A74A8 56 Bytes [ 50, 38, 6A, 00, 6A, 0C, 5A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionExW + A 3D9A74E1 13 Bytes [ 1C, FF, 75, 18, FF, 75, 14, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionExW + 19 3D9A74F0 30 Bytes CALL 3D9A87B0 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionExW + 38 3D9A750F 71 Bytes JMP 3D9A88B8 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionExW + 80 3D9A7557 5 Bytes [ 50, E8, DC, FA, FF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetOptionExW + 86 3D9A755D 102 Bytes [ 5F, 5E, 33, C0, 5B, 8B, E5, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ResumeSuspendedDownload 3D9A957F 147 Bytes [ 90, 8B, FF, 55, 8B, EC, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ResumeSuspendedDownload + 94 3D9A9613 18 Bytes [ 00, 69, 00, 63, 00, 72, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ResumeSuspendedDownload + A7 3D9A9626 9 Bytes [ 57, 00, 69, 00, 6E, 00, 64, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ResumeSuspendedDownload + B1 3D9A9630 9 Bytes [ 77, 00, 73, 00, 5C, 00, 43, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ResumeSuspendedDownload + BB 3D9A963A 24 Bytes [ 72, 00, 72, 00, 65, 00, 6E, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DispatchAPICall + 39 3D9A9E82 26 Bytes [ 8B, 4D, 1C, 89, 45, FC, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DispatchAPICall + 54 3D9A9E9D 3 Bytes [ 23, 20, FF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DispatchAPICall + 58 3D9A9EA1 4 Bytes [ 57, 8D, 8D, E4 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DispatchAPICall + 5D 3D9A9EA6 12 Bytes CALL 3D99BEC2 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DispatchAPICall + 6A 3D9A9EB3 23 Bytes CALL 3D99BEC3 C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!_GetFileExtensionFromUrl + 2 3D9ABA7E 132 Bytes [ FF, 85, C0, 0F, 8C, 6E, 13, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!_GetFileExtensionFromUrl + 87 3D9ABB03 105 Bytes [ 8D, 47, 48, 8B, 30, EB, 18, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!_GetFileExtensionFromUrl + F1 3D9ABB6D 77 Bytes [ 15, 68, 11, F1, 77, 83, C4, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!_GetFileExtensionFromUrl + 13F 3D9ABBBB 7 Bytes [ 8B, 3D, 7C, 11, F1, 77, 53 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!_GetFileExtensionFromUrl + 147 3D9ABBC3 30 Bytes [ D7, FF, 35, 30, 45, F5, 77, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFortezzaCommand + 12 3D9ABF6D 26 Bytes [ 10, F1, 77, 8B, C6, E9, EC, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFortezzaCommand + 2D 3D9ABF88 60 Bytes [ BC, 43, F5, 77, 00, 75, 0D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFortezzaCommand + 6A 3D9ABFC5 43 Bytes [ EB, 08, 66, 83, A5, F4, FD, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFortezzaCommand + 96 3D9ABFF1 50 Bytes [ 8B, 75, 10, 8B, 45, 10, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetFortezzaCommand + C9 3D9AC024 197 Bytes [ C0, 5D, C2, 14, 00, 90, 90, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileA + A 3D9AEF32 10 Bytes [ E0, EB, 52, 90, 90, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileA + 15 3D9AEF3D 31 Bytes [ 8B, 00, 8B, 00, 89, 45, E4, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileA + 35 3D9AEF5D 47 Bytes [ 80, 74, 19, 3D, 96, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileA + 65 3D9AEF8D 120 Bytes [ F9, FB, FF, C3, 90, 90, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileA + DE 3D9AF006 2 Bytes [ FF, FF ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileA + 2 3D9AF029 51 Bytes [ FF, FF, F0, 80, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileA + 36 3D9AF05D 18 Bytes [ FF, FF, FF, FF, 00, 0F, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileA + 49 3D9AF070 14 Bytes [ F8, 00, 0F, FF, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileA + 58 3D9AF07F 8 Bytes [ FF, F8, 00, 0F, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileA + 61 3D9AF088 15 Bytes [ FF, FF, FF, F0, 07, 0F, FF, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileSize + 1F 3D9B02CC 70 Bytes [ 25, 0F, BE, C0, 50, FF, 15, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileSize + 66 3D9B0313 53 Bytes [ EB, 4B, 3B, F2, 8B, 5D, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileSize + 9C 3D9B0349 73 Bytes [ FF, 8B, F0, 85, F6, 74, BF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileSize + E6 3D9B0393 29 Bytes [ 98, 90, 90, 90, 90, 90, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileSize + 104 3D9B03B1 22 Bytes [ 57, 8B, BB, 3C, 04, 00, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpDeleteFileA + 7 3D9B0726 14 Bytes [ 2B, CF, 1B, C3, 89, 8E, 68, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpDeleteFileA + 16 3D9B0735 209 Bytes [ 00, F7, C2, 00, 00, 02, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryA + 79 3D9B0807 69 Bytes [ 0F, 85, 53, 9E, 04, 00, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryA + BF 3D9B084D 16 Bytes [ 3E, 53, 8D, 45, FC, 50, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryA + D1 3D9B085F 122 Bytes [ 8D, 8E, 64, 03, 00, 00, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryA + 14C 3D9B08DA 14 Bytes [ F1, 57, 8D, 8E, B0, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryA + 15B 3D9B08E9 82 Bytes [ 68, FF, 00, 00, 00, 56, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandA + 17 3D9B093C 46 Bytes [ FF, 8B, 86, 94, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandA + 46 3D9B096B 41 Bytes [ 7E, 70, 89, 7E, 74, 89, 7E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandA + 70 3D9B0995 165 Bytes [ BE, A4, 00, 00, 00, E8, C5, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandA + 116 3D9B0A3B 18 Bytes [ FF, 85, C0, 75, 08, 8B, 4E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandA + 129 3D9B0A4E 10 Bytes [ 90, 90, 90, 90, 8B, FF, 55, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryA + 9 3D9B13F3 1 Byte [ F0 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryA + B 3D9B13F5 37 Bytes [ 15, 4C, 11, DD, 77, 33, C0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryA + 31 3D9B141B 11 Bytes [ FE, C3, 66, 83, 7E, 02, 30, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryA + 3D 3D9B1427 11 Bytes JMP 3D9BDAE7 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryA + 49 3D9B1433 31 Bytes JMP 3D9B1181 C:\WINDOWS\system32\WININET.dll .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpFindFirstFileA + B 3D9B14AB 13 Bytes [ 15, 4C, 11, DD, 77, 8B, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpFindFirstFileA + 19 3D9B14B9 15 Bytes [ 00, 6A, 57, EB, EC, 8D, 74, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileA + 2 3D9B14C9 6 Bytes [ 85, C0, 0F, 84, AB, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileA + 9 3D9B14D0 141 Bytes CALL 3D994D59 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileA + 97 3D9B155E 102 Bytes [ 00, 8B, 0E, 33, C0, 85, C9, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileA + FF 3D9B15C6 12 Bytes CALL 3D9B15D4 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileA + 10C 3D9B15D3 158 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpFindFirstFileW + 16 3D9B174B 238 Bytes [ 4D, 2C, 3B, CE, 0F, 85, 92, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpFindFirstFileW + 105 3D9B183A 98 Bytes CALL C912F554 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpDeleteFileW + 39 3D9B189D 122 Bytes [ C8, 8B, 45, B8, 83, E1, 03, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpRenameFileW + 1 3D9B1918 2 Bytes [ 4D, C4 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpRenameFileW + 4 3D9B191B 87 Bytes JMP C95B4C22 .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpRenameFileW + 5C 3D9B1973 101 Bytes [ 25, 04, 60, E4, 77, 8D, 46, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpRenameFileW + C2 3D9B19D9 123 Bytes [ D8, 83, 4D, FC, FF, 83, 7B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileW 3D9B1A55 30 Bytes [ 90, 90, 90, 90, 8B, FF, 55, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileW + 1F 3D9B1A74 25 Bytes [ 83, C4, 0C, 5D, C2, 0C, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileW + 39 3D9B1A8E 67 Bytes [ 83, F8, 0A, 0F, 87, 74, 04, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileW + 7D 3D9B1AD2 21 Bytes [ 15, 08, 10, DD, 77, 85, C0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpOpenFileW + 94 3D9B1AE9 25 Bytes [ CC, 15, DD, 77, 8B, 06, 66, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCreateDirectoryW + E 3D9B1B1D 9 Bytes [ C0, EB, F6, 8B, 4E, 0C, 2B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCreateDirectoryW + 18 3D9B1B27 112 Bytes [ 03, 03, 4D, 08, 03, D1, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCreateDirectoryW + 89 3D9B1B98 233 Bytes JMP 3D9B04D6 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryW + F 3D9B1C82 64 Bytes [ 75, 0C, FF, 75, 08, E8, 2D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryW + 50 3D9B1CC3 30 Bytes [ 04, 50, 68, BE, 68, DE, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryW + 6F 3D9B1CE2 42 Bytes [ 55, 8B, EC, 51, 8B, 45, 08, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpSetCurrentDirectoryW + 9A 3D9B1D0D 141 Bytes [ 85, C0, 0F, 84, 3D, 18, 01, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryW + 77 3D9B1D9B 31 Bytes [ 0C, 01, 0F, 85, 29, BF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryW + 98 3D9B1DBC 50 Bytes [ 53, FF, 75, 18, 6A, 01, 56, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetCurrentDirectoryW + CE 3D9B1DF2 31 Bytes [ 8B, FF, 55, 8B, EC, 83, EC, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandW + 1F 3D9B1E12 10 Bytes [ 75, 14, FF, 75, 10, FF, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandW + 2A 3D9B1E1D 15 Bytes [ FF, FF, 85, C0, 75, 1C, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandW + 3B 3D9B1E2E 1 Byte [ EC ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandW + 3D 3D9B1E30 39 Bytes [ FF, 75, 10, FF, 75, 0C, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpCommandW + 65 3D9B1E58 23 Bytes [ 75, 24, FF, 75, 20, FF, 75, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileW + 25 3D9B2544 105 Bytes [ A4, 00, 00, 00, 3C, 30, 40, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileEx + 41 3D9B25AE 35 Bytes [ 2F, 3B, 46, 3B, 68, 3B, 7C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileEx + 65 3D9B25D2 64 Bytes [ 20, 3E, 49, 3E, 6F, 3E, 7D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpGetFileEx + A6 3D9B2613 207 Bytes [ 36, 8B, 36, 19, 37, 45, 37, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileEx + C4 3D9B26E3 23 Bytes [ 3E, A4, 3E, BE, 3E, 1F, 3F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileEx + DD 3D9B26FC 144 Bytes [ 59, 30, 6A, 30, 6F, 30, 7D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileEx + 16E 3D9B278D 21 Bytes [ 3A, E1, 3A, 12, 3B, 2D, 3B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileEx + 184 3D9B27A3 58 Bytes [ 00, 28, 01, 00, 00, 88, 34, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FtpPutFileEx + 1BF 3D9B27DE 113 Bytes [ 90, 36, 96, 36, 9C, 36, A6, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GopherOpenFileA + 3E 3D9B663F 37 Bytes [ 2D, 03, 80, 00, 00, 74, 16, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GopherOpenFileA + 64 3D9B6665 7 Bytes [ 14, 56, 33, F6, 85, D2, 76 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GopherOpenFileA + 6C 3D9B666D 47 Bytes [ 8B, 45, 10, 8D, 44, 10, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GopherOpenFileA + 9C 3D9B669D 14 Bytes [ E4, 8B, 06, 80, 38, 00, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GopherOpenFileA + AB 3D9B66AC 26 Bytes [ E4, 0F, B6, 08, 8D, 78, 01, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteWpadCacheForNetworks + 47 3D9B6881 93 Bytes [ 89, 38, 75, F0, 5F, 5E, 5B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteWpadCacheForNetworks + A6 3D9B68E0 1 Byte [ 0C ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteWpadCacheForNetworks + A8 3D9B68E2 31 Bytes CALL 3D9B6831 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteWpadCacheForNetworks + C8 3D9B6902 233 Bytes [ 0C, 38, 89, 0A, 03, C3, 5F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteWpadCacheForNetworks + 1B2 3D9B69EC 176 Bytes [ 84, C0, 8A, 16, 74, 12, 3A, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacySetZonePreferenceW + 4 3D9BA075 57 Bytes [ 06, 6A, 01, 8B, CE, FF, 50, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacySetZonePreferenceW + 3E 3D9BA0AF 136 Bytes JMP 3D9AE7E7 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacySetZonePreferenceW + C7 3D9BA138 37 Bytes [ 5E, 1C, 74, 3B, 53, EB, 17, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacySetZonePreferenceW + ED 3D9BA15E 16 Bytes [ 6B, E2, FD, FF, C7, 46, 1C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!PrivacySetZonePreferenceW + FF 3D9BA170 10 Bytes [ FC, FF, 15, 58, 13, E7, 77, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpCheckDavCompliance + 45 3D9BA3B2 18 Bytes JMP 3D98A1DB C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpCheckDavCompliance + 58 3D9BA3C5 40 Bytes [ 00, 00, 00, 0F, 83, 7C, E2, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpCheckDavCompliance + 81 3D9BA3EE 34 Bytes [ 81, FF, E5, 03, 00, 00, 0F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpCheckDavCompliance + A4 3D9BA411 87 Bytes [ 93, D0, 00, 00, 00, 0F, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpCheckDavCompliance + FC 3D9BA469 3 Bytes [ 8B, 83, AC ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestExA + 2A 3D9BA784 44 Bytes [ 45, FC, 83, C0, 38, 39, 45, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestExA + 57 3D9BA7B1 110 Bytes [ 00, 00, 00, 89, 70, 38, 8B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpSendRequestExW + 6D 3D9BA820 67 Bytes [ 8B, B4, 00, 00, 00, 89, 48, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpEndRequestA + 2 3D9BA864 1 Byte [ FF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpEndRequestA + 4 3D9BA866 65 Bytes [ 00, 01, 00, 00, B8, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpEndRequestW + 14 3D9BA8A8 46 Bytes [ 81, FE, 17, 00, 00, C0, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpEndRequestW + 43 3D9BA8D7 30 Bytes [ BE, BE, 06, 00, 00, E9, 6F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpEndRequestW + 62 3D9BA8F6 128 Bytes [ 1C, 8D, 45, F0, 50, FF, 77, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpEndRequestW + E3 3D9BA977 41 Bytes JMP 3D998C41 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!HttpEndRequestW + 10E 3D9BA9A2 36 Bytes [ 00, 80, 49, 1C, 80, 8B, 48, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetPerSiteCookieDecisionA + 2 3D9BAEB7 5 Bytes [ 05, 21, 07, 00, 00 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetPerSiteCookieDecisionA + 8 3D9BAEBD 70 Bytes [ F0, 57, 6A, 6F, 56, 6A, 02, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetPerSiteCookieDecisionA + 4F 3D9BAF04 21 Bytes [ 15, 04, 12, E7, 77, EB, 5D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetPerSiteCookieDecisionA + 65 3D9BAF1A 101 Bytes [ 89, 48, 50, FF, 76, 68, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetPerSiteCookieDecisionW + 61 3D9BAF80 77 Bytes JMP 3D99F78E C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetPerSiteCookieDecisionW + 11 3D9BAFCE 634 Bytes [ FF, 75, 10, FF, 76, 04, 68, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetClearAllPerSiteCookieDecisions + 135 3D9BB249 121 Bytes [ 93, 93, 93, 93, 93, B6, B6, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetClearAllPerSiteCookieDecisions + 1AF 3D9BB2C3 1307 Bytes [ 74, 74, 74, 74, 74, 93, 93, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetClearAllPerSiteCookieDecisions + 6CB 3D9BB7DF 33 Bytes [ 5D, 5D, 5D, 7E, 7E, 7E, 7E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetClearAllPerSiteCookieDecisions + 6ED 3D9BB801 612 Bytes [ 5D, 7E, 7E, 7E, 7E, 7E, 7E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetClearAllPerSiteCookieDecisions + 952 3D9BBA66 65 Bytes [ 74, 16, 16, 93, 93, 93, 93, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieA + B 3D9BBE43 32 Bytes [ 75, 75, 16, 16, 16, 16, 16, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieA + B 3D9BBE64 2 Bytes [ 75, 75 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieA + E 3D9BBE67 15 Bytes [ 16, 16, 94, 94, 94, 94, 94, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieA + 1E 3D9BBE77 45 Bytes [ D8, 32, 32, 32, 53, 53, 53, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieW + 11 3D9BBEA5 2 Bytes [ 75, 75 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetGetCookieW + 14 3D9BBEA8 23 Bytes [ 94, 94, 94, 94, 94, 94, B7, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSetCookieW + 9 3D9BBEC0 423 Bytes [ 53, 53, 75, 75, 75, 75, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeToSystemTimeW + A8 3D9BC068 119 Bytes [ 01, 33, C0, 8B, 4D, FC, 5F, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTimeW + 6C 3D9BC0E0 54 Bytes [ 20, 3B, F3, 74, 1C, 80, FA, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTimeW + A3 3D9BC117 27 Bytes [ 4D, 20, 89, 19, 8B, 4D, 24, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTimeW + BF 3D9BC133 86 Bytes JMP 3D9BBE6C C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTimeW + 116 3D9BC18A 34 Bytes [ 90, 90, 90, 90, 8B, FF, 55, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetTimeFromSystemTimeW + 139 3D9BC1AD 34 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UrlZonesDetach + 4D 3D9BF947 52 Bytes [ 00, A8, FF, 5B, 08, 08, 5B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UrlZonesDetach + 82 3D9BF97C 59 Bytes [ 12, 08, 25, 5C, 46, 5C, 24, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UrlZonesDetach + BE 3D9BF9B8 141 Bytes [ 12, 08, 25, 5C, 5B, 08, 08, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UrlZonesDetach + 14C 3D9BFA46 80 Bytes [ 3C, 00, 16, 03, 18, 00, 4B, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UrlZonesDetach + 19D 3D9BFA97 6 Bytes [ 00, FE, FF, FE, FF, FF ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheGroup + 24 3D9C3C2B 21 Bytes [ 74, FF, FF, FF, 5E, C9, C2, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!CreateUrlCacheGroup + 3A 3D9C3C41 47 Bytes [ 0C, 3B, 75, 10, 0F, 85, BB, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerA 3D9C3C71 10 Bytes JMP 3D9C2447 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerA + B 3D9C3C7C 25 Bytes JMP 3D9C2484 C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerA + 25 3D9C3C96 25 Bytes [ 43, 00, 55, 00, 52, 00, 49, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerA + 3F 3D9C3CB0 15 Bytes [ 54, 00, 48, 00, 45, 00, 4E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerW + B 3D9C3CC0 3 Bytes [ 54, 00, 49 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerW + F 3D9C3CC4 37 Bytes [ 4F, 00, 4E, 00, 5F, 00, 49, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerW + 35 3D9C3CEA 17 Bytes [ 61, 00, 41, 00, 75, 00, 74, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheContainerW + 47 3D9C3CFC 46 Bytes [ 63, 00, 61, 00, 74, 00, 69, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheEntryW + 1 3D9C3D2B 91 Bytes [ 45, 0C, 56, 8B, 75, 08, 66, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheEntryW + 5D 3D9C3D87 54 Bytes [ 18, 00, 00, 00, 89, 9D, 3C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheGroup + 16 3D9C3DBE 11 Bytes [ FF, 15, 6C, 11, FE, 77, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheGroup + 22 3D9C3DCA 34 Bytes [ 89, 85, 5C, FF, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!DeleteUrlCacheGroup + 45 3D9C3DED 23 Bytes [ 7C, FF, FF, FF, 50, C7, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheGroup + A 3D9C3E05 11 Bytes [ 00, C6, 85, 58, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheGroup + 18 3D9C3E13 33 Bytes [ C7, 85, 60, FF, FF, FF, 8C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheGroup + 3A 3D9C3E35 35 Bytes [ FF, 68, E4, 4C, FE, 77, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindFirstUrlCacheGroup + 5E 3D9C3E59 44 Bytes [ FF, FF, 50, 8D, 85, 30, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheContainerW + 15 3D9C3E86 56 Bytes [ FF, 5F, 5B, 8B, 4D, FC, 5E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheContainerW + 4E 3D9C3EBF 18 Bytes [ 68, 90, 4C, FE, 77, 8D, 85, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheContainerW + 61 3D9C3ED2 10 Bytes [ FF, 89, 85, 48, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheContainerW + 6C 3D9C3EDD 66 Bytes [ FF, FF, 50, 33, DB, 68, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheGroup + 2D 3D9C3F20 21 Bytes [ 00, 00, 57, 53, 6A, 01, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheGroup + 43 3D9C3F36 16 Bytes [ FF, FF, 8B, F8, FF, 15, 70, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheGroup + 54 3D9C3F47 53 Bytes [ 00, 6A, 23, 59, 33, C0, 8D, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExW + 31 3D9C3F7D 30 Bytes [ FF, 8C, 00, 00, 00, FF, D6, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExW + 50 3D9C3F9C 38 Bytes [ 8D, 85, 30, FF, FF, FF, 50, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FindNextUrlCacheEntryExW + 77 3D9C3FC3 79 Bytes [ FF, C9, C2, 04, 00, 66, 83, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FreeUrlCacheSpaceA + 12 3D9C4013 36 Bytes [ 3A, 45, 3A, 69, 3A, 94, 3A, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FreeUrlCacheSpaceA + 37 3D9C4038 11 Bytes [ D9, 3D, 0E, 3E, F0, 3E, E7, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FreeUrlCacheSpaceA + 43 3D9C4044 32 Bytes [ 6C, 00, 00, 00, 47, 30, 46, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!FreeUrlCacheSpaceW + 1C 3D9C4065 174 Bytes [ 34, 6E, 34, 96, 34, C3, 34, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheConfigInfoA + 4C 3D9C4114 74 Bytes [ 10, 30, 2D, 30, 4F, 31, EF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheConfigInfoW + 46 3D9C415F 210 Bytes [ 34, 3A, 34, 8A, 34, B5, 34, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!GetUrlCacheGroupAttributeW + 2A 3D9C4232 328 Bytes [ 00, 00, 3A, 31, 4F, 31, 6E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!IsUrlCacheEntryExpiredA + 9E 3D9C437B 732 Bytes [ 3F, 00, C0, 00, 00, D0, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheGroupAttributeW + 5A 3D9C4658 29 Bytes [ 72, 30, C7, 31, E4, 31, 02, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheGroupAttributeW + 78 3D9C4676 247 Bytes [ AE, 33, CB, 33, DE, 33, E9, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UpdateUrlCacheContentPath + 6A 3D9C476E 37 Bytes [ 8E, 3D, 94, 3D, 99, 3D, B7, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!UpdateUrlCacheContentPath + 90 3D9C4794 287 Bytes [ 1F, 30, 2F, 30, 39, 30, 4E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheConfigInfoA + 5F 3D9C48B4 123 Bytes [ F9, 3F, 00, 00, 00, 80, 01, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheConfigInfoA + DB 3D9C4930 118 Bytes [ 74, 00, 00, 00, DB, 30, F0, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheConfigInfoA + 152 3D9C49A7 127 Bytes [ 00, 00, 30, 1C, 31, 20, 31, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheConfigInfoA + 1D2 3D9C4A27 151 Bytes [ 39, 06, 39, 11, 39, 18, 39, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!SetUrlCacheConfigInfoA + 26A 3D9C4ABF 112 Bytes [ 3F, 00, C0, 01, 00, FC, 00, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowSecurityInfo + 11 3D9C962D 57 Bytes JMP 3D9C1D6F C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowSecurityInfo + 4B 3D9C9667 19 Bytes [ FF, 11, 0F, 84, B5, DF, 01, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowSecurityInfo + 5F 3D9C967B 11 Bytes [ 75, 2A, FF, 75, 18, FF, 75, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowSecurityInfo + 6B 3D9C9687 20 Bytes [ 75, 0C, 6A, 01, 56, 56, E8, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowSecurityInfo + 80 3D9C969C 16 Bytes [ FF, 75, 08, 85, C0, 0F, 85, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ParseX509EncodedCertificateForListBoxEntry + 9 3D9C97F6 4 Bytes CALL 3D9C980D C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ParseX509EncodedCertificateForListBoxEntry + E 3D9C97FB 8 Bytes [ 00, 5F, 5E, 5B, 5D, C2, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowX509EncodedCertificate + 4 3D9C9804 4 Bytes [ CA, 8B, C2, EB ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowX509EncodedCertificate + 9 3D9C9809 20 Bytes [ 90, 90, 90, 90, 90, 8B, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowX509EncodedCertificate + 1E 3D9C981E 148 Bytes [ 75, 0C, FF, 75, 08, FF, 15, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowX509EncodedCertificate + B3 3D9C98B3 57 Bytes [ 8B, 55, 30, 56, 8B, 75, 08, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!ShowX509EncodedCertificate + ED 3D9C98ED 4 Bytes [ B5, DC, FD, FF ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringA + 9 3D9C9BC2 1 Byte [ 72 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringA + B 3D9C9BC4 41 Bytes [ 74, 00, 66, 00, 00, 00, 90, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringA + 35 3D9C9BEE 1 Byte [ 73 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringA + 37 3D9C9BF0 55 Bytes [ 00, 00, 90, 90, 2E, 78, 6C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringA + 6F 3D9C9C28 21 Bytes [ 74, 00, 6D, 00, 00, 00, 90, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringW 3D9C9D17 9 Bytes [ 90, 2E, 00, 61, 00, 73, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringW + B 3D9C9D22 34 Bytes [ 90, 90, 2E, 00, 77, 00, 61, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringW + 2F 3D9C9D46 7 Bytes [ 90, 90, 2E, 00, 6D, 00, 33 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringW + 37 3D9C9D4E 35 Bytes [ 75, 00, 00, 00, 90, 90, 2E, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetAlgIdToStringW + 5D 3D9C9D74 21 Bytes [ 2E, 00, 61, 00, 69, 00, 66, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSecurityProtocolToStringA + 23 3D9C9EA8 1 Byte [ 05 ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSecurityProtocolToStringA + 25 3D9C9EAA 206 Bytes [ 00, 00, 5C, 10, F7, 77, 7C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSecurityProtocolToStringW + 19 3D9C9F79 8 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSecurityProtocolToStringW + 22 3D9C9F82 133 Bytes [ F7, 77, 18, 0D, F7, 77, 0C, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSecurityProtocolToStringW + A8 3D9CA008 54 Bytes [ FF, FF, FF, FF, FF, FF, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSecurityProtocolToStringW + DF 3D9CA03F 22 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetSecurityProtocolToStringW + F6 3D9CA056 9 Bytes [ F9, FF, 1F, FE, F7, FE, 77, ... ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetErrorDlg + 41 3D9CA7A4 31 Bytes [ FF, 85, C0, 8B, 7D, FC, 74, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetErrorDlg + 61 3D9CA7C4 5 Bytes [ 75, 08, E8, BD, DF ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetErrorDlg + 67 3D9CA7CA 124 Bytes [ FF, 8B, F0, 85, F6, 74, 09, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetErrorDlg + E4 3D9CA847 29 Bytes [ 41, 73, 73, 6F, 63, 69, 61, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetErrorDlg + 102 3D9CA865 7 Bytes [ EC, FF, 75, 10, FF, 75, 08 ] .text ... .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + 35 3D9CAC8B 3 Bytes [ B5, B4, FE ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + 39 3D9CAC8F 76 Bytes CALL 3D9A458C C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + 86 3D9CACDC 8 Bytes [ 75, 27, 8D, 85, BC, FE, FF, ... ] .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + 8F 3D9CACE5 30 Bytes CALL 3D9CB15E C:\WINDOWS\system32\WININET.dll .text C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[4008] WININET.dll!InternetConfirmZoneCrossing + AE 3D9CAD04 17 Bytes [ FF, FF, B5, A0, FE, FF, FF, ... ] .text ... ---- Devices - GMER 1.0.12 ---- Device \FileSystem\cdudf_xp \Device\CdUdf_XP IRP_MJ_FILE_SYSTEM_CONTROL [A8795EC8] tfsnifs.sys Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL [A8795D30] tfsnifs.sys ---- Registry - GMER 1.0.12 ---- Reg \Registry\USER\S-1-5-21-2063061788-1251265980-2345815548-1007\Software\SecuROM\License information@datasecu 0xF1 0x37 0x4A 0x62 ... Reg \Registry\USER\S-1-5-21-2063061788-1251265980-2345815548-1007\Software\SecuROM\License information@rkeysecu 0xCB 0xBD 0xF2 0x61 ... ---- Files - GMER 1.0.12 ---- ADS C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 ADS C:\Documents and Settings\Laura\Favorites\Links\Suggested Sites.url:favicon ADS C:\Documents and Settings\Mason\Favorites\Links\Suggested Sites.url:favicon ADS C:\Documents and Settings\Mike\Favorites\Links\Suggested Sites.url:favicon ADS C:\Documents and Settings\Mike\My Documents\My Pictures\bevhillbilliesBIG.jpg:SummaryInformation ADS C:\Documents and Settings\Mike\My Documents\My Pictures\bevhillbilliesBIG.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ADS C:\Documents and Settings\Mike\My Documents\My Pictures\HSC Images\HSC B&W.jpg:SummaryInformation ADS C:\Documents and Settings\Mike\My Documents\My Pictures\HSC Images\HSC B&W.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ADS C:\Documents and Settings\Mike\My Documents\My Pictures\HSC Images\Limulus Univ.jpg:SummaryInformation ADS C:\Documents and Settings\Mike\My Documents\My Pictures\HSC Images\Limulus Univ.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ADS C:\Documents and Settings\Mike\My Documents\My Pictures\HSC Images\Spawning Dept.jpg:SummaryInformation ADS ... ---- EOF - GMER 1.0.12 ----