GMER 1.0.15.15273 - http://www.gmer.net Rootkit scan 2009-12-08 23:39:50 Windows 6.0.6002 Service Pack 2 Running: de7scdbu.exe; Driver: C:\Users\Rajiv\AppData\Local\Temp\pglcrpod.sys ---- System - GMER 1.0.15 ---- Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x9502679E] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x95026738] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x9502674C] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x950267DC] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0x9502681F] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0x95026710] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0x95026724] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x950267B2] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0x95026847] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0x95026833] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0x9502678A] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x95026776] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0x9502680B] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x950267F2] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0x950267C8] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateUserProcess [0x95026762] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwYieldExecution 82262982 5 Bytes JMP 950267CC \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwNotifyChangeKey 823F65B5 5 Bytes JMP 95026823 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwCreateUserProcess 82400B82 5 Bytes JMP 95026766 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwTerminateProcess 82427D5D 5 Bytes JMP 9502680F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!NtMapViewOfSection 82447446 7 Bytes JMP 950267E0 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 82447709 5 Bytes JMP 950267F6 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!NtSetInformationProcess 8244B474 5 Bytes JMP 9502677A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 82450E7D 7 Bytes JMP 950267B6 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!NtOpenThread 8245309A 5 Bytes JMP 95026728 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!NtOpenProcess 82457B48 5 Bytes JMP 95026714 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!NtCreateFile 82478D59 5 Bytes JMP 950267A2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwRestoreKey 824897B2 5 Bytes JMP 95026837 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwReplaceKey 8248A9B6 5 Bytes JMP 9502684B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwCreateProcess 824C874B 5 Bytes JMP 9502673C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwCreateProcessEx 824C8796 7 Bytes JMP 95026750 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntkrnlpa.exe!ZwSetContextThread 824C9253 5 Bytes JMP 9502678E \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) .text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C005340, 0x296027, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\Windows\system32\svchost.exe[360] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 002200DA .text C:\Windows\system32\svchost.exe[360] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 002200C9 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 002200EB .text C:\Windows\system32\svchost.exe[360] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00220F54 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00220FC0 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00220025 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00220036 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00220F9E .text C:\Windows\system32\svchost.exe[360] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 0022009A .text C:\Windows\system32\svchost.exe[360] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00220062 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00220073 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00220051 .text C:\Windows\system32\svchost.exe[360] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00220FAF .text C:\Windows\system32\svchost.exe[360] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 002200FC .text C:\Windows\system32\svchost.exe[360] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00220FEF .text C:\Windows\system32\svchost.exe[360] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 0022000A .text C:\Windows\system32\svchost.exe[360] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00220F6F .text C:\Windows\system32\svchost.exe[360] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00210F97 .text C:\Windows\system32\svchost.exe[360] msvcrt.dll!system 7778804B 5 Bytes JMP 00210022 .text C:\Windows\system32\svchost.exe[360] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00210FBC .text C:\Windows\system32\svchost.exe[360] msvcrt.dll!_open 7778D106 5 Bytes JMP 00210000 .text C:\Windows\system32\svchost.exe[360] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00210011 .text C:\Windows\system32\svchost.exe[360] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00210FD7 .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00450F83 .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00450FA8 .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00450000 .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00450025 .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00450F72 .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00450FCA .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00450FE5 .text C:\Windows\system32\svchost.exe[360] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00450FB9 .text C:\Windows\system32\svchost.exe[360] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00200000 .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[540] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[540] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text C:\Windows\system32\services.exe[684] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 002B0F30 .text C:\Windows\system32\services.exe[684] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 002B0076 .text C:\Windows\system32\services.exe[684] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 002B00A2 .text C:\Windows\system32\services.exe[684] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 002B0F0B .text C:\Windows\system32\services.exe[684] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 002B004A .text C:\Windows\system32\services.exe[684] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 002B0FC3 .text C:\Windows\system32\services.exe[684] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 002B0F9E .text C:\Windows\system32\services.exe[684] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 002B0065 .text C:\Windows\system32\services.exe[684] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 002B0F70 .text C:\Windows\system32\services.exe[684] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 002B0025 .text C:\Windows\system32\services.exe[684] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 002B0F8D .text C:\Windows\system32\services.exe[684] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 002B000A .text C:\Windows\system32\services.exe[684] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 002B0F55 .text C:\Windows\system32\services.exe[684] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 002B00BD .text C:\Windows\system32\services.exe[684] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 002B0FD4 .text C:\Windows\system32\services.exe[684] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 002B0FEF .text C:\Windows\system32\services.exe[684] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 002B0091 .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 002E0F6B .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 002E0F97 .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 002E0FEF .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 002E0F7C .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 002E0F50 .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 002E0FC3 .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 002E0FD4 .text C:\Windows\system32\services.exe[684] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 002E0FB2 .text C:\Windows\system32\services.exe[684] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 002A0047 .text C:\Windows\system32\services.exe[684] msvcrt.dll!system 7778804B 5 Bytes JMP 002A002C .text C:\Windows\system32\services.exe[684] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 002A0FC6 .text C:\Windows\system32\services.exe[684] msvcrt.dll!_open 7778D106 5 Bytes JMP 002A0000 .text C:\Windows\system32\services.exe[684] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 002A001B .text C:\Windows\system32\services.exe[684] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 002A0FE3 .text C:\Windows\system32\services.exe[684] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00290000 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 009E0F43 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 009E0F54 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 009E00C9 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 009E0F32 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 009E0FA5 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 009E002C .text C:\Windows\system32\lsass.exe[696] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 009E0FDB .text C:\Windows\system32\lsass.exe[696] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 009E0F6F .text C:\Windows\system32\lsass.exe[696] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 009E0073 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 009E0FC0 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 009E0062 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 009E0047 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 009E0F80 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 009E0F17 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 009E001B .text C:\Windows\system32\lsass.exe[696] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 009E0000 .text C:\Windows\system32\lsass.exe[696] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 009E00AE .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 009F0F94 .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 009F0036 .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 009F000A .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 009F0FA5 .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 009F0F83 .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 009F0FE5 .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 009F001B .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 009F0FCA .text C:\Windows\system32\lsass.exe[696] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00870F90 .text C:\Windows\system32\lsass.exe[696] msvcrt.dll!system 7778804B 5 Bytes JMP 0087001B .text C:\Windows\system32\lsass.exe[696] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00870FC6 .text C:\Windows\system32\lsass.exe[696] msvcrt.dll!_open 7778D106 5 Bytes JMP 00870000 .text C:\Windows\system32\lsass.exe[696] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00870FAB .text C:\Windows\system32\lsass.exe[696] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00870FE3 .text C:\Windows\system32\lsass.exe[696] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00110FEF .text C:\Windows\system32\svchost.exe[904] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00D700BC .text C:\Windows\system32\svchost.exe[904] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00D70097 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00D700E1 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00D70F40 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00D70075 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00D70FCA .text C:\Windows\system32\svchost.exe[904] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00D70011 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00D70086 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00D70064 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00D7002C .text C:\Windows\system32\svchost.exe[904] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00D7003D .text C:\Windows\system32\svchost.exe[904] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00D70FA5 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00D70F80 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 00D700F2 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00D70000 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00D70FE5 .text C:\Windows\system32\svchost.exe[904] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00D70F5B .text C:\Windows\system32\svchost.exe[904] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00D60FC3 .text C:\Windows\system32\svchost.exe[904] msvcrt.dll!system 7778804B 5 Bytes JMP 00D6004E .text C:\Windows\system32\svchost.exe[904] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00D60022 .text C:\Windows\system32\svchost.exe[904] msvcrt.dll!_open 7778D106 5 Bytes JMP 00D60000 .text C:\Windows\system32\svchost.exe[904] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00D60033 .text C:\Windows\system32\svchost.exe[904] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00D60011 .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00D90FB2 .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00D90FCD .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00D9000A .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00D90054 .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00D90079 .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00D90FDE .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00D90FEF .text C:\Windows\system32\svchost.exe[904] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00D9002F .text C:\Windows\system32\svchost.exe[904] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00D10FE5 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00970F26 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00970F41 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00970EFA .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00970087 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00970051 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00970FD4 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00970FB9 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 0097006C .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00970F83 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00970F9E .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00970040 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00970025 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00970F5C .text C:\Windows\system32\svchost.exe[964] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 009700B6 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00970FE5 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00970000 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00970F0B .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00920042 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!system 7778804B 5 Bytes JMP 00920FB7 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00920FC8 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_open 7778D106 5 Bytes JMP 00920000 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 0092001D .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00920FE3 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00990040 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00990FC3 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00990FEF .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00990FA8 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00990051 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00990025 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00990014 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00990FD4 .text C:\Windows\system32\svchost.exe[964] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00910000 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00E60F46 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00E6008C .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00E600D6 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00E60F35 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00E60F72 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00E60FCA .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00E6001B .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00E60F61 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00E60040 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00E60F9E .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00E60F83 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00E60FAF .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00E60067 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 00E600E7 .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00E6000A .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00E60FEF .text C:\Windows\System32\svchost.exe[1076] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00E600B1 .text C:\Windows\System32\svchost.exe[1076] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00E50053 .text C:\Windows\System32\svchost.exe[1076] msvcrt.dll!system 7778804B 5 Bytes JMP 00E50038 .text C:\Windows\System32\svchost.exe[1076] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00E50027 .text C:\Windows\System32\svchost.exe[1076] msvcrt.dll!_open 7778D106 5 Bytes JMP 00E50000 .text C:\Windows\System32\svchost.exe[1076] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00E50FD2 .text C:\Windows\System32\svchost.exe[1076] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00E50FE3 .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00E70051 .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00E70025 .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00E70FEF .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00E70040 .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00E7006C .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00E70FD4 .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00E7000A .text C:\Windows\System32\svchost.exe[1076] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00E70FB9 .text C:\Windows\System32\svchost.exe[1076] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00970FEF .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00DD00C6 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00DD00AB .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00DD0F43 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00DD0F54 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00DD0F80 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00DD0022 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00DD0FC7 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00DD0090 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00DD005A .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00DD0F91 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00DD003D .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00DD0FB6 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00DD0075 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 00DD0F32 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00DD0011 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00DD0000 .text C:\Windows\System32\svchost.exe[1132] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00DD0F65 .text C:\Windows\System32\svchost.exe[1132] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00DC0031 .text C:\Windows\System32\svchost.exe[1132] msvcrt.dll!system 7778804B 5 Bytes JMP 00DC0FA6 .text C:\Windows\System32\svchost.exe[1132] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00DC0FC1 .text C:\Windows\System32\svchost.exe[1132] msvcrt.dll!_open 7778D106 5 Bytes JMP 00DC0FEF .text C:\Windows\System32\svchost.exe[1132] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00DC0016 .text C:\Windows\System32\svchost.exe[1132] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00DC0FD2 .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00DE0047 .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00DE0036 .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00DE000A .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00DE0FAF .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00DE0F8A .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00DE001B .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00DE0FEF .text C:\Windows\System32\svchost.exe[1132] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00DE0FCA .text C:\Windows\System32\svchost.exe[1132] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00DB0000 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00360062 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00360F26 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00360EC1 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00360EDC .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00360F6D .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00360FCA .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00360FB9 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00360F37 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00360051 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00360F9E .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00360040 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00360025 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00360F5C .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 00360073 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00360000 .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00360FEF .text C:\Windows\system32\svchost.exe[1164] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00360EF7 .text C:\Windows\system32\svchost.exe[1164] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00350058 .text C:\Windows\system32\svchost.exe[1164] msvcrt.dll!system 7778804B 5 Bytes JMP 0035003D .text C:\Windows\system32\svchost.exe[1164] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00350011 .text C:\Windows\system32\svchost.exe[1164] msvcrt.dll!_open 7778D106 5 Bytes JMP 00350FEF .text C:\Windows\system32\svchost.exe[1164] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 0035002C .text C:\Windows\system32\svchost.exe[1164] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00350000 .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00370F9E .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00370036 .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00370000 .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00370FB9 .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00370F8D .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00370011 .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00370FDB .text C:\Windows\system32\svchost.exe[1164] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00370FCA .text C:\Windows\system32\svchost.exe[1164] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00340FEF .text C:\Windows\system32\svchost.exe[1164] WININET.dll!InternetOpenA 7766D690 5 Bytes JMP 015E0FEF .text C:\Windows\system32\svchost.exe[1164] WININET.dll!InternetOpenW 7766DB09 5 Bytes JMP 015E0FDE .text C:\Windows\system32\svchost.exe[1164] WININET.dll!InternetOpenUrlA 7766F3A4 5 Bytes JMP 015E0FC3 .text C:\Windows\system32\svchost.exe[1164] WININET.dll!InternetOpenUrlW 776B6DDF 5 Bytes JMP 015E0FB2 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00910F50 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00910F61 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 009100B1 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00910F1A .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 0091007B .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00910FCD .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00910FBC .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 0091008C .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00910054 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00910032 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00910043 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00910FAB .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00910F86 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 00910EFF .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00910FDE .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00910FEF .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00910F35 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00DB0065 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00DB0FC3 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00DB0FEF .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00DB004A .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00DB0FB2 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00DB0025 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00DB000A .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00DB0FD4 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00900027 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] msvcrt.dll!system 7778804B 5 Bytes JMP 00900F9C .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00900FC8 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] msvcrt.dll!_open 7778D106 5 Bytes JMP 00900FE3 .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00900FAD .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 0090000C .text C:\Windows\system32\inetsrv\inetinfo.exe[1176] WS2_32.dll!socket 771D36D1 5 Bytes JMP 008F0000 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 001C0F0E .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 001C0F1F .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 001C0ECE .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 001C006F .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 001C0040 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 001C0FD4 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 001C001B .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 001C0F3A .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 001C0F72 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 001C0FA8 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 001C0F8D .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 001C0FB9 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 001C0F4B .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 001C0EB3 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 001C0FE5 .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 001C000A .text C:\Windows\system32\svchost.exe[1280] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 001C0EF3 .text C:\Windows\system32\svchost.exe[1280] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 001B0042 .text C:\Windows\system32\svchost.exe[1280] msvcrt.dll!system 7778804B 5 Bytes JMP 001B0FB7 .text C:\Windows\system32\svchost.exe[1280] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 001B0FD2 .text C:\Windows\system32\svchost.exe[1280] msvcrt.dll!_open 7778D106 5 Bytes JMP 001B0FE3 .text C:\Windows\system32\svchost.exe[1280] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 001B0027 .text C:\Windows\system32\svchost.exe[1280] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 001B000C .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 001D0069 .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 001D0047 .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 001D0000 .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 001D0058 .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 001D0FAC .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 001D0FEF .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 001D0025 .text C:\Windows\system32\svchost.exe[1280] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 001D0036 .text C:\Windows\system32\svchost.exe[1280] WS2_32.dll!socket 771D36D1 5 Bytes JMP 001A0FEF .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00EE007B .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00EE0F35 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00EE00A7 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00EE0096 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00EE003B .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00EE0FC3 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00EE0FA8 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00EE0056 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00EE0F61 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00EE0F8D .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00EE0F72 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00EE001E .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00EE0F50 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 00EE00B8 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00EE0FD4 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00EE0FE5 .text C:\Windows\system32\svchost.exe[1336] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00EE0F1A .text C:\Windows\system32\svchost.exe[1336] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00E80055 .text C:\Windows\system32\svchost.exe[1336] msvcrt.dll!system 7778804B 5 Bytes JMP 00E80FD4 .text C:\Windows\system32\svchost.exe[1336] msvcrt.dll!_creat 7778BBE1 1 Byte [E9] .text C:\Windows\system32\svchost.exe[1336] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00E80FE5 .text C:\Windows\system32\svchost.exe[1336] msvcrt.dll!_open 7778D106 5 Bytes JMP 00E80000 .text C:\Windows\system32\svchost.exe[1336] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00E8003A .text C:\Windows\system32\svchost.exe[1336] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00E80029 .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00EF0F8A .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00EF001B .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00EF0FE5 .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00EF0036 .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00EF0047 .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00EF0FAF .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00EF0FD4 .text C:\Windows\system32\svchost.exe[1336] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00EF0000 .text C:\Windows\system32\svchost.exe[1336] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00190FEF .text C:\Windows\system32\svchost.exe[1336] WinInet.dll!InternetOpenA 7766D690 5 Bytes JMP 00E30000 .text C:\Windows\system32\svchost.exe[1336] WinInet.dll!InternetOpenW 7766DB09 5 Bytes JMP 00E30FE5 .text C:\Windows\system32\svchost.exe[1336] WinInet.dll!InternetOpenUrlA 7766F3A4 5 Bytes JMP 00E3001B .text C:\Windows\system32\svchost.exe[1336] WinInet.dll!InternetOpenUrlW 776B6DDF 5 Bytes JMP 00E3002C .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 010C00BB .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 010C0F75 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 010C0F49 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 010C00E0 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 010C0082 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 010C0FCA .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 010C0025 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreatePipe 77808E6E 3 Bytes JMP 010C0F86 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreatePipe + 4 77808E72 1 Byte [89] .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 010C0065 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!LoadLibraryW 77809362 3 Bytes JMP 010C0FB9 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!LoadLibraryW + 4 77809366 1 Byte [89] .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!LoadLibraryExA 778094B4 3 Bytes JMP 010C0FA8 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!LoadLibraryExA + 4 778094B8 1 Byte [89] .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!LoadLibraryA 778094DC 3 Bytes JMP 010C0040 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!LoadLibraryA + 4 778094E0 1 Byte [89] .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!VirtualProtectEx 7780DBDA 3 Bytes JMP 010C0F97 .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!VirtualProtectEx + 4 7780DBDE 1 Byte [89] .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 010C00FB .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 010C000A .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 010C0FEF .text C:\Windows\system32\svchost.exe[1532] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 010C0F64 .text C:\Windows\system32\svchost.exe[1532] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 01060FAD .text C:\Windows\system32\svchost.exe[1532] msvcrt.dll!system 7778804B 5 Bytes JMP 01060038 .text C:\Windows\system32\svchost.exe[1532] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 0106000C .text C:\Windows\system32\svchost.exe[1532] msvcrt.dll!_open 7778D106 5 Bytes JMP 01060FEF .text C:\Windows\system32\svchost.exe[1532] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 01060027 .text C:\Windows\system32\svchost.exe[1532] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 01060FD2 .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 010D0076 .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 010D0FCA .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 010D0FEF .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 010D0051 .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 010D0087 .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 010D0025 .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 010D000A .text C:\Windows\system32\svchost.exe[1532] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 010D0036 .text C:\Windows\system32\svchost.exe[1532] WS2_32.dll!socket 771D36D1 5 Bytes JMP 01010FEF .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 01220F35 .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 01220F46 .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 012200B8 .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 012200A7 .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 01220F72 .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 01220FD4 .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 0122001B .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 01220F57 .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 0122004C .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 01220F9E .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 01220F8D .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 01220FAF .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 0122005D .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 01220EFC .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 0122000A .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 01220FEF .text C:\Windows\system32\svchost.exe[1788] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 01220096 .text C:\Windows\system32\svchost.exe[1788] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 01210FCA .text C:\Windows\system32\svchost.exe[1788] msvcrt.dll!system 7778804B 5 Bytes JMP 01210055 .text C:\Windows\system32\svchost.exe[1788] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 0121003A .text C:\Windows\system32\svchost.exe[1788] msvcrt.dll!_open 7778D106 5 Bytes JMP 0121000C .text C:\Windows\system32\svchost.exe[1788] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 01210FE5 .text C:\Windows\system32\svchost.exe[1788] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 01210029 .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 01230F91 .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 0123003D .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 01230000 .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 01230FAC .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 01230058 .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 01230011 .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 01230FE5 .text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 0123002C .text C:\Windows\system32\svchost.exe[1788] WS2_32.dll!socket 771D36D1 5 Bytes JMP 011C0FE5 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 001D009B .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 001D0F55 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 001D0F04 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 001D0F1F .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 001D0F95 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 001D0FD4 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 001D0FC3 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 001D008A .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 001D0FB2 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 001D004A .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 001D0065 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 001D002F .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 001D0F84 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 001D0EE9 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 001D0FEF .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 001D0000 .text C:\Windows\system32\svchost.exe[2148] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 001D0F30 .text C:\Windows\system32\svchost.exe[2148] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 001B004A .text C:\Windows\system32\svchost.exe[2148] msvcrt.dll!system 7778804B 5 Bytes JMP 001B002F .text C:\Windows\system32\svchost.exe[2148] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 001B0FC6 .text C:\Windows\system32\svchost.exe[2148] msvcrt.dll!_open 7778D106 5 Bytes JMP 001B0FE3 .text C:\Windows\system32\svchost.exe[2148] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 001B0FB5 .text C:\Windows\system32\svchost.exe[2148] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 001B0000 .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 001E004A .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 001E0FA8 .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 001E0FEF .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 001E002F .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 001E0F8D .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 001E0014 .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 001E0FD4 .text C:\Windows\system32\svchost.exe[2148] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 001E0FC3 .text C:\Windows\system32\svchost.exe[2148] WS2_32.dll!socket 771D36D1 5 Bytes JMP 0010000A .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 000100AE .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00010F68 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00010F39 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 000100D0 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00010F9E .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00010FDE .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 0001002F .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00010093 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00010078 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00010FC3 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 0001005B .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00010040 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00010F8D .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 000100E1 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 0001000A .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00010FEF .text C:\Program Files\Internet Explorer\iexplore.exe[2332] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 000100BF .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00040FA8 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00040040 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00040FEF .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00040FB9 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 0004005B .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 0004000A .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00040FCA .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 0004001B .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!CreateWindowExW 77941305 5 Bytes JMP 6E6AD67C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!DialogBoxParamW 779610B0 5 Bytes JMP 6E5D5435 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!DialogBoxIndirectParamW 77962EF5 5 Bytes JMP 6E7A418F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!DialogBoxParamA 77978152 5 Bytes JMP 6E7A412C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!DialogBoxIndirectParamA 7797847D 5 Bytes JMP 6E7A41F2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!MessageBoxIndirectA 7798D4D9 5 Bytes JMP 6E7A40C1 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!MessageBoxIndirectW 7798D5D3 5 Bytes JMP 6E7A4056 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!MessageBoxExA 7798D639 5 Bytes JMP 6E7A3FF4 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] USER32.dll!MessageBoxExW 7798D65D 5 Bytes JMP 6E7A3F92 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2332] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00050F9C .text C:\Program Files\Internet Explorer\iexplore.exe[2332] msvcrt.dll!system 7778804B 5 Bytes JMP 00050027 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00050FC1 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] msvcrt.dll!_open 7778D106 5 Bytes JMP 00050FEF .text C:\Program Files\Internet Explorer\iexplore.exe[2332] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00050016 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00050FD2 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] WININET.dll!InternetOpenA 7766D690 5 Bytes JMP 002C0FEF .text C:\Program Files\Internet Explorer\iexplore.exe[2332] WININET.dll!InternetOpenW 7766DB09 5 Bytes JMP 002C0FDE .text C:\Program Files\Internet Explorer\iexplore.exe[2332] WININET.dll!InternetOpenUrlA 7766F3A4 5 Bytes JMP 002C000A .text C:\Program Files\Internet Explorer\iexplore.exe[2332] WININET.dll!InternetOpenUrlW 776B6DDF 5 Bytes JMP 002C0FC3 .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ws2_32.dll!closesocket 771D330C 5 Bytes JMP 100116A0 C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ws2_32.dll!WSASocketW 771D34EB 7 Bytes JMP 100115C7 C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ws2_32.dll!socket 771D36D1 5 Bytes JMP 002E000A .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ws2_32.dll!connect 771D40D9 5 Bytes JMP 1001162A C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ws2_32.dll!bind 771D652F 5 Bytes JMP 10011551 C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[2332] ws2_32.dll!WSAConnect 771DD7B0 5 Bytes JMP 1001165F C:\Windows\System32\cfgbkend32.dll .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00F100BA .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00F1009F .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00F100F0 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00F100D5 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00F10069 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00F10036 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00F10047 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00F10084 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00F10F9B .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00F10058 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00F10FAC .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00F10FDB .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00F10F74 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 00F10101 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00F10025 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00F10000 .text C:\Windows\system32\svchost.exe[2440] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00F10F59 .text C:\Windows\system32\svchost.exe[2440] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00F00FA4 .text C:\Windows\system32\svchost.exe[2440] msvcrt.dll!system 7778804B 5 Bytes JMP 00F0002F .text C:\Windows\system32\svchost.exe[2440] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00F0000A .text C:\Windows\system32\svchost.exe[2440] msvcrt.dll!_open 7778D106 5 Bytes JMP 00F00FE3 .text C:\Windows\system32\svchost.exe[2440] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00F00FB5 .text C:\Windows\system32\svchost.exe[2440] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00F00FC6 .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00F20F8D .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00F20FB9 .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00F20FEF .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00F20F9E .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00F20054 .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00F20FD4 .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00F2000A .text C:\Windows\system32\svchost.exe[2440] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00F20025 .text C:\Windows\system32\svchost.exe[2440] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00A60000 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00890F22 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00890F3D .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00890F00 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 0089008D .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00890F70 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00890FD4 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00890FB9 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00890F4E .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00890F81 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00890040 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00890FA8 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 0089002F .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 00890F5F .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 008900B2 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00890FEF .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 0089000A .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 00890F11 .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00400FA6 .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!system 7778804B 5 Bytes JMP 00400FB7 .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 0040001D .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_open 7778D106 5 Bytes JMP 00400FEF .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00400FC8 .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 0040000C .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 008A0F9E .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 008A0040 .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 008A0000 .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 008A0FB9 .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 008A005B .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 008A0FE5 .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 008A001B .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 008A0FD4 .text C:\Windows\system32\svchost.exe[2504] WS2_32.dll!socket 771D36D1 5 Bytes JMP 003F0000 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!GetStartupInfoW 777E1929 3 Bytes JMP 000A0F55 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!GetStartupInfoW + 4 777E192D 1 Byte [88] .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!GetStartupInfoA 777E19C9 3 Bytes JMP 000A009B .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!GetStartupInfoA + 4 777E19CD 1 Byte [88] .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateProcessW 777E1BF3 3 Bytes JMP 000A00C0 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateProcessW + 4 777E1BF7 1 Byte [88] .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateProcessA 777E1C28 3 Bytes JMP 000A0F33 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateProcessA + 4 777E1C2C 1 Byte [88] .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!VirtualProtect 777E1DC3 3 Bytes JMP 000A0F81 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!VirtualProtect + 4 777E1DC7 1 Byte [88] .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateNamedPipeA 777E2EF5 3 Bytes JMP 000A0FCA .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateNamedPipeA + 4 777E2EF9 1 Byte [88] .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateNamedPipeW 777E5C0C 3 Bytes JMP 000A001B .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateNamedPipeW + 4 777E5C10 1 Byte [88] .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 000A008A .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 000A005B .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 000A004A .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 000A0F9E .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 000A0FB9 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 000A0F70 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 000A0F18 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 000A000A .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 000A0FE5 .text C:\Windows\System32\svchost.exe[2528] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 000A0F44 .text C:\Windows\System32\svchost.exe[2528] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00090047 .text C:\Windows\System32\svchost.exe[2528] msvcrt.dll!system 7778804B 5 Bytes JMP 00090FBC .text C:\Windows\System32\svchost.exe[2528] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00090FD7 .text C:\Windows\System32\svchost.exe[2528] msvcrt.dll!_open 7778D106 5 Bytes JMP 00090000 .text C:\Windows\System32\svchost.exe[2528] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00090036 .text C:\Windows\System32\svchost.exe[2528] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00090011 .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 000B0F83 .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 000B001B .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 000B0FE5 .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 000B0F94 .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 000B0F72 .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 000B0FB9 .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 000B0FD4 .text C:\Windows\System32\svchost.exe[2528] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 000B000A .text C:\Windows\System32\svchost.exe[2528] WS2_32.dll!socket 771D36D1 5 Bytes JMP 00700000 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 00010F3C .text C:\Windows\Explorer.EXE[2864] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00010082 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 00010F1A .text C:\Windows\Explorer.EXE[2864] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00010F2B .text C:\Windows\Explorer.EXE[2864] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00010042 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00010FB9 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 0001000A .text C:\Windows\Explorer.EXE[2864] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00010F57 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00010F68 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00010F94 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00010F83 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 0001001B .text C:\Windows\Explorer.EXE[2864] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 0001005D .text C:\Windows\Explorer.EXE[2864] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 000100C2 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00010FD4 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00010FE5 .text C:\Windows\Explorer.EXE[2864] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 000100A7 .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00050036 .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00050FAF .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00050FE5 .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00050F9E .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00050F6F .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00050000 .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00050FD4 .text C:\Windows\Explorer.EXE[2864] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00050011 .text C:\Windows\Explorer.EXE[2864] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00060058 .text C:\Windows\Explorer.EXE[2864] msvcrt.dll!system 7778804B 5 Bytes JMP 0006003D .text C:\Windows\Explorer.EXE[2864] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 00060FDE .text C:\Windows\Explorer.EXE[2864] msvcrt.dll!_open 7778D106 5 Bytes JMP 00060FEF .text C:\Windows\Explorer.EXE[2864] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00060FCD .text C:\Windows\Explorer.EXE[2864] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00060018 .text C:\Windows\Explorer.EXE[2864] WS2_32.dll!socket 771D36D1 5 Bytes JMP 02AB0000 .text C:\Windows\Explorer.EXE[2864] WININET.dll!InternetOpenA 7766D690 5 Bytes JMP 02D1000A .text C:\Windows\Explorer.EXE[2864] WININET.dll!InternetOpenW 7766DB09 5 Bytes JMP 02D10FE5 .text C:\Windows\Explorer.EXE[2864] WININET.dll!InternetOpenUrlA 7766F3A4 5 Bytes JMP 02D10FCA .text C:\Windows\Explorer.EXE[2864] WININET.dll!InternetOpenUrlW 776B6DDF 5 Bytes JMP 02D10025 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!GetStartupInfoW 777E1929 5 Bytes JMP 000100A9 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!GetStartupInfoA 777E19C9 5 Bytes JMP 00010F63 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreateProcessW 777E1BF3 5 Bytes JMP 000100D5 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreateProcessA 777E1C28 5 Bytes JMP 00010F3E .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!VirtualProtect 777E1DC3 5 Bytes JMP 00010F7E .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreateNamedPipeA 777E2EF5 5 Bytes JMP 00010000 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreateNamedPipeW 777E5C0C 5 Bytes JMP 00010011 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreatePipe 77808E6E 5 Bytes JMP 00010098 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!LoadLibraryExW 77809109 5 Bytes JMP 00010062 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!LoadLibraryW 77809362 5 Bytes JMP 00010036 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!LoadLibraryExA 778094B4 5 Bytes JMP 00010047 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!LoadLibraryA 778094DC 5 Bytes JMP 00010FAF .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!VirtualProtectEx 7780DBDA 5 Bytes JMP 0001007D .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!GetProcAddress 7782903B 5 Bytes JMP 000100E6 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreateFileW 7782AECB 5 Bytes JMP 00010FCA .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreateFileA 7782CE5F 5 Bytes JMP 00010FEF .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!WinExec 77875CF7 5 Bytes JMP 000100BA .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegCreateKeyExA 77E239AB 5 Bytes JMP 00040F90 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegCreateKeyA 77E23BA9 5 Bytes JMP 00040FA1 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegOpenKeyA 77E289C7 5 Bytes JMP 00040FEF .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegCreateKeyW 77E3391E 5 Bytes JMP 00040032 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegCreateKeyExW 77E341F1 5 Bytes JMP 00040F75 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegOpenKeyExA 77E37C42 5 Bytes JMP 00040FC3 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegOpenKeyW 77E3E2B5 5 Bytes JMP 00040FDE .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ADVAPI32.dll!RegOpenKeyExW 77E47BA1 5 Bytes JMP 00040FB2 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateDialogParamW 779372A2 5 Bytes JMP 6E6ADA08 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!GetAsyncKeyState 7793863C 5 Bytes JMP 6E5C90EF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!SetWindowsHookExW 779387AD 5 Bytes JMP 6E6A97F5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CallNextHookEx 77938E3B 5 Bytes JMP 6E69CE79 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!UnhookWindowsHookEx 779398DB 5 Bytes JMP 6E61466C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!EnableWindow 7793CD8B 5 Bytes JMP 6E6AD895 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateWindowExW 77941305 5 Bytes JMP 6E6AD67C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!GetKeyState 77948CB1 5 Bytes JMP 6E6ACE43 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!IsDialogMessageW 77950745 5 Bytes JMP 6E5D5947 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateDialogParamA 779517AA 5 Bytes JMP 6E7A4DFB C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!IsDialogMessage 77951847 5 Bytes JMP 6E7A4697 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateDialogIndirectParamA 779526F1 5 Bytes JMP 6E7A4E32 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateDialogIndirectParamW 77959A62 5 Bytes JMP 6E7A4E69 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!SetKeyboardState 77960987 5 Bytes JMP 6E7A4A06 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxParamW 779610B0 5 Bytes JMP 6E5D5435 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxIndirectParamW 77962EF5 5 Bytes JMP 6E7A418F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!SendInput 77962F75 5 Bytes JMP 6E7A55C3 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!EndDialog 7796326E 5 Bytes JMP 6E5D7DEE C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!SetCursorPos 77976FB2 5 Bytes JMP 6E7A5617 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxParamA 77978152 5 Bytes JMP 6E7A412C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxIndirectParamA 7797847D 5 Bytes JMP 6E7A41F2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxIndirectA 7798D4D9 5 Bytes JMP 6E7A40C1 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxIndirectW 7798D5D3 5 Bytes JMP 6E7A4056 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxExA 7798D639 5 Bytes JMP 6E7A3FF4 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxExW 7798D65D 5 Bytes JMP 6E7A3F92 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!keybd_event 7798D972 5 Bytes JMP 6E7A5947 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] msvcrt.dll!_wsystem 77787F2F 5 Bytes JMP 00050064 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] msvcrt.dll!system 7778804B 5 Bytes JMP 00050049 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] msvcrt.dll!_creat 7778BBE1 5 Bytes JMP 0005001D .text C:\Program Files\Internet Explorer\iexplore.exe[5264] msvcrt.dll!_open 7778D106 5 Bytes JMP 00050000 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] msvcrt.dll!_wcreat 7778D326 5 Bytes JMP 00050038 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] msvcrt.dll!_wopen 7778D501 5 Bytes JMP 00050FEF .text C:\Program Files\Internet Explorer\iexplore.exe[5264] SHELL32.dll!SHRestricted + D95 76748988 4 Bytes [4D, 30, EA, 74] .text C:\Program Files\Internet Explorer\iexplore.exe[5264] SHELL32.dll!SHRestricted + D9D 76748990 8 Bytes JMP E95B9C74 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ole32.dll!OleLoadFromStream 77C01E12 5 Bytes JMP 6E7A44F7 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ole32.dll!CoCreateInstance 77C39EA6 5 Bytes JMP 6E6AD6D8 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ws2_32.dll!closesocket 771D330C 5 Bytes JMP 100116A0 C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ws2_32.dll!WSASocketW 771D34EB 7 Bytes JMP 100115C7 C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ws2_32.dll!socket 771D36D1 5 Bytes JMP 000F0000 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ws2_32.dll!connect 771D40D9 5 Bytes JMP 1001162A C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ws2_32.dll!bind 771D652F 5 Bytes JMP 10011551 C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ws2_32.dll!WSAConnect 771DD7B0 5 Bytes JMP 1001165F C:\Windows\System32\cfgbkend32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WININET.dll!InternetOpenA 7766D690 5 Bytes JMP 00350FE5 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WININET.dll!InternetOpenW 7766DB09 5 Bytes JMP 00350FD4 .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WININET.dll!InternetOpenUrlA 7766F3A4 5 Bytes JMP 0035000A .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WININET.dll!InternetOpenUrlW 776B6DDF 5 Bytes JMP 0035001B ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\USER32.dll [GDI32.dll!GetStockObject] [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [GDI32.dll!GetStockObject] [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!GetSysColor] [61138FE2] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW] [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA] [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [GDI32.dll!GetStockObject] [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenuEx] [61138FA4] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [61138F66] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColorBrush] [611390A5] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColor] [61138FE2] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DefWindowProcW] [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[4848] @ C:\Windows\system32\SHELL32.dll [USER32.dll!AnimateWindow] [611390DD] C:\Program Files\Yahoo!\Messenger\yui.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SearchPathW] [74E91AEC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [74E9007C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CopyFileW] [74E8E1E9] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!MoveFileW] [74E90994] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!DeleteFileW] [74E8EE46] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateProcessW] [74E8A3FB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetCurrentDirectoryW] [74E91D56] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindClose] [74E93ADC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindNextFileW] [74E92999] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindFirstFileW] [74E93035] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [74E8FBE1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW] [74E8E860] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!WritePrivateProfileStringW] [74E8DC5C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [74E8FD66] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetPrivateProfileStringW] [74E8D4B8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegQueryInfoKeyW] [74E9FBB3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegEnumValueW] [74EA051D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegOpenKeyExW] [74E9EB3D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegQueryValueExW] [74E9F817] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegDeleteKeyW] [74E9EF31] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegCreateKeyExW] [74E9E5C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegCloseKey] [74E9ED95] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [74E9007C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [74E8FBE1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW] [74E8E1E9] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [74E8FD66] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW] [74E8E860] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SearchPathW] [74E91AEC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW] [74E8EE46] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindClose] [74E93ADC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindFirstFileA] [74E92CD2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindNextFileA] [74E92926] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindFirstFileW] [74E93035] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindNextFileW] [74E92999] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!GetFileAttributesA] [74E8BD77] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetCurrentDirectoryA] [74E9173F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetFileAttributesA] [74E8BFCD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateDirectoryA] [74E90F0F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!RemoveDirectoryA] [74E914E9] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!DeleteFileA] [74E8ED1B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!GetFileAttributesW] [74E8BEA2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetCurrentDirectoryW] [74E91D56] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetFileAttributesW] [74E8C0FB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateDirectoryW] [74E9103D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!DeleteFileW] [74E8EE46] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!MoveFileW] [74E90994] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!RemoveDirectoryW] [74E91614] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!MoveFileA] [74E90921] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [74E8FBE1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateProcessA] [74E8A073] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateProcessW] [74E8A3FB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateFileA] [74E8E717] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateFileW] [74E8E860] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryW] [74E8FD66] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [74E8FD66] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!ReplaceFileW] [74E90C95] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!WritePrivateProfileStringW] [74E8DC5C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringW] [74E8D4B8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringA] [74E8D361] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW] [74E8EE46] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [74E9007C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW] [74E8C0FB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW] [74E8E860] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileW] [74E93035] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileW] [74E92999] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathW] [74E91AEC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesW] [74E8BEA2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA] [74E8BFCD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA] [74E8E717] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileA] [74E92CD2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileA] [74E92926] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindClose] [74E93ADC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathA] [74E923A5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesA] [74E8BD77] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [74E8FBE1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!WinHelpW] [74E8FAAA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!WinHelpA] [74E8F973] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCloseKey] [74E9ED95] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExA] [74E9E43D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteKeyA] [74E9EDE8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryInfoKeyA] [74E9F9B7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExA] [74E9E9C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExW] [74E9E5C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExW] [74E9EB3D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyExW] [74EA020D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryValueW] [74E9F4DB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteKeyW] [74E9EF31] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryInfoKeyW] [74E9FBB3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryValueExW] [74E9F817] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumValueW] [74EA051D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyW] [74E9FF19] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyExA] [74EA0085] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumValueA] [74EA0395] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyA] [74E9FDAF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryValueExA] [74E9F677] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionW] [74E8CFA8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!FindNextFileW] [74E92999] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!ReplaceFileW] [74E90C95] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionNamesW] [74E8D22A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileSectionW] [74E8D9DA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileStringW] [74E8DC5C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateHardLinkW] [74E8EB68] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetCurrentDirectoryW] [74E91D56] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW] [74E8E1E9] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetBinaryTypeW] [74E8CAA7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [74E9007C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateProcessW] [74E8A3FB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW] [74E90994] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!FindFirstFileW] [74E93035] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!FindClose] [74E93ADC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameA] [74E8C709] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetFileAttributesA] [74E8BD77] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SearchPathW] [74E91AEC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileIntW] [74E8CD20] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileStringW] [74E8D4B8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!RemoveDirectoryW] [74E91614] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateDirectoryW] [74E9103D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!DeleteFileW] [74E8EE46] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetFileAttributesW] [74E8C0FB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetFileAttributesW] [74E8BEA2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW] [74E909B9] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameW] [74E8C848] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [74E8FD66] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateFileW] [74E8E860] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetFileAttributesExW] [74E8C368] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [74E8FBE1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetLongPathNameW] [74E8C5D8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [USER32.dll!LoadImageW] [74E8F0D0] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [USER32.dll!WinHelpW] [74E8FAAA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [USER32.dll!PrivateExtractIconsW] [74E8F5C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCreateFromUrlW] [74E965DA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringByKeyW] [74E9620B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHCreateStreamOnFileW] [74E97595] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryKeyW] [74E960AE] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringW] [74E9615B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyA] [74E975E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCombineW] [74E96533] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHOpenRegStream2W] [74E9799A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryW] [74E9684F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsURLW] [74E96E45] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootA] [74E96AFB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootW] [74E96B47] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripToRootW] [74E97281] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFindOnPathW] [74E96716] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripPathW] [74E971ED] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRemoveArgsW] [74E97021] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetBoolUSValueW] [74E97FBE] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathSkipRootW] [74E97159] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryEmptyW] [74E968E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsSystemFolderW] [74E96BE2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryA] [74E96803] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRelativePathToW] [74E96F81] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootA] [74E963A5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetPathW] [74E980BD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegSetPathW] [74E98513] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetUSValueW] [74E98176] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHQueryValueExW] [74E97BA4] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetValueW] [74E98235] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsNetworkPathW] [74E9697F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerShareW] [74E96DAD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerW] [74E96D15] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathUnExpandEnvStringsW] [74E9731F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathMakeSystemFolderW] [74E96EDD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCW] [74E96C7D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRelativeW] [74E96AAF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHGetValueW] [74E978EA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootW] [74E963F4] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteValueW] [74E976D7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHSetValueW] [74E98732] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumKeyExW] [74E9777E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumValueW] [74E97831] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFileExistsW] [74E9667B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyW] [74E97636] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!NtQueryDirectoryFile] [74E8BB38] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!FindClose] [74E93ADC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!FindFirstFileW] [74E93035] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [74E9007C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!SearchPathW] [74E91AEC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateProcessW] [74E8A3FB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!DeleteFileW] [74E8EE46] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetShortPathNameW] [74E8C848] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesExW] [74E8C368] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateFileW] [74E8E860] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [74E8FD66] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesW] [74E8BEA2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [74E8FBE1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\ws2_32.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueW] [74E98235] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueA] [74E981D7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathUnExpandEnvStringsA] [74E972CD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteKeyA] [74E975E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteValueW] [74E976D7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCreateFromUrlW] [74E965DA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueA] [74E9788F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueA] [74E986D7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueW] [74E978EA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueW] [74E98732] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCombineW] [74E96533] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SAMLIB.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\IPHLPAPI.DLL [KERNEL32.dll!GetProcAddress] [74E882F6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat 0x30 0x9E 0xAD 0xDE ... ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 sector 01: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 02: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 03: copy of MBR Disk \Device\Harddisk0\DR0 sector 04: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 05: copy of MBR Disk \Device\Harddisk0\DR0 sector 06: copy of MBR Disk \Device\Harddisk0\DR0 sector 07: copy of MBR Disk \Device\Harddisk0\DR0 sector 08: copy of MBR Disk \Device\Harddisk0\DR0 sector 09: copy of MBR Disk \Device\Harddisk0\DR0 sector 10: copy of MBR Disk \Device\Harddisk0\DR0 sector 11: copy of MBR Disk \Device\Harddisk0\DR0 sector 12: copy of MBR Disk \Device\Harddisk0\DR0 sector 13: copy of MBR Disk \Device\Harddisk0\DR0 sector 14: copy of MBR Disk \Device\Harddisk0\DR0 sector 15: copy of MBR Disk \Device\Harddisk0\DR0 sector 16: copy of MBR Disk \Device\Harddisk0\DR0 sector 17: copy of MBR Disk \Device\Harddisk0\DR0 sector 18: copy of MBR Disk \Device\Harddisk0\DR0 sector 19: copy of MBR Disk \Device\Harddisk0\DR0 sector 20: copy of MBR Disk \Device\Harddisk0\DR0 sector 21: copy of MBR Disk \Device\Harddisk0\DR0 sector 22: copy of MBR Disk \Device\Harddisk0\DR0 sector 23: copy of MBR Disk \Device\Harddisk0\DR0 sector 24: copy of MBR Disk \Device\Harddisk0\DR0 sector 25: copy of MBR Disk \Device\Harddisk0\DR0 sector 26: copy of MBR Disk \Device\Harddisk0\DR0 sector 27: copy of MBR Disk \Device\Harddisk0\DR0 sector 28: copy of MBR Disk \Device\Harddisk0\DR0 sector 29: copy of MBR Disk \Device\Harddisk0\DR0 sector 30: copy of MBR Disk \Device\Harddisk0\DR0 sector 31: copy of MBR Disk \Device\Harddisk0\DR0 sector 32: copy of MBR Disk \Device\Harddisk0\DR0 sector 33: copy of MBR Disk \Device\Harddisk0\DR0 sector 34: copy of MBR Disk \Device\Harddisk0\DR0 sector 35: copy of MBR Disk \Device\Harddisk0\DR0 sector 36: copy of MBR Disk \Device\Harddisk0\DR0 sector 37: copy of MBR Disk \Device\Harddisk0\DR0 sector 38: copy of MBR Disk \Device\Harddisk0\DR0 sector 39: copy of MBR Disk \Device\Harddisk0\DR0 sector 40: copy of MBR Disk \Device\Harddisk0\DR0 sector 41: copy of MBR Disk \Device\Harddisk0\DR0 sector 42: copy of MBR Disk \Device\Harddisk0\DR0 sector 43: copy of MBR Disk \Device\Harddisk0\DR0 sector 44: copy of MBR Disk \Device\Harddisk0\DR0 sector 45: copy of MBR Disk \Device\Harddisk0\DR0 sector 46: copy of MBR Disk \Device\Harddisk0\DR0 sector 47: copy of MBR Disk \Device\Harddisk0\DR0 sector 48: copy of MBR Disk \Device\Harddisk0\DR0 sector 49: copy of MBR Disk \Device\Harddisk0\DR0 sector 50: copy of MBR Disk \Device\Harddisk0\DR0 sector 51: copy of MBR Disk \Device\Harddisk0\DR0 sector 52: copy of MBR Disk \Device\Harddisk0\DR0 sector 53: copy of MBR Disk \Device\Harddisk0\DR0 sector 54: copy of MBR Disk \Device\Harddisk0\DR0 sector 55: copy of MBR Disk \Device\Harddisk0\DR0 sector 56: copy of MBR Disk \Device\Harddisk0\DR0 sector 57: copy of MBR Disk \Device\Harddisk0\DR0 sector 58: copy of MBR Disk \Device\Harddisk0\DR0 sector 59: copy of MBR Disk \Device\Harddisk0\DR0 sector 60: copy of MBR Disk \Device\Harddisk0\DR0 sector 61: copy of MBR Disk \Device\Harddisk0\DR0 sector 62: copy of MBR Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR ---- EOF - GMER 1.0.15 ----