[Closed] Blue screens! yech! Part 2

Hi, I let a dialogue lapse as i was out of town. Here is the last comment from TomK and the logs that I've attached below:

dpennmaas,

Nothing showing.

Let's dig deeper.

Please download gmer.zip from Gmer and save it to your desktop.


1.Right click on gmer.zip and select Extract All….
2.Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
3.Click on the Browse button. Click on Desktop. Then click OK.
4.Click Next. It will start extracting.
5.Once done, check (tick) the Show extracted files box and click Finish.
6.Double click on gmer.exe to run it.
7.Select the Rootkit tab.
8.On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
9.Select all drives that are connected to your system to be scanned.
10.Click on the Scan button.
11.When the scan is finished, click Copy to save the scan log to the Windows clipboard.
12.Open Notepad or a similar text editor.
13.Paste the clipboard contents into the text editor.
14.Save the Gmer scan log and post it in your next reply.


GMER 1.0.15.15020 [gmer.exe] - http://www.gmer.net
Rootkit scan 2009-08-13 20:35:52
Windows 5.1.2600 Service Pack 3


—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xA0EC24BA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xA0EC2468]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xA0EC247C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xA0EC24FA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xA0EC2440]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xA0EC2454]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xA0EC24CE]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xA0EC24A6]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xA0EC2492]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xA0EC2529]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xA0EC2510]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xA0EC24E4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwYieldExecution 80504AE8 7 Bytes JMP A0EC24E8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtCreateFile 80579084 5 Bytes JMP A0EC24BE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 805B2006 7 Bytes JMP A0EC24FE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805B2E14 5 Bytes JMP A0EC2514 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 805B83E6 7 Bytes JMP A0EC24D2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenProcess 805CB408 5 Bytes JMP A0EC2444 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenThread 805CB694 5 Bytes JMP A0EC2458 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtSetInformationProcess 805CDE52 5 Bytes JMP A0EC2496 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1142 7 Bytes JMP A0EC2480 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcess 805D11F8 5 Bytes JMP A0EC246C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwSetContextThread 805D1702 5 Bytes JMP A0EC24AA \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 805D29AA 5 Bytes JMP A0EC252D \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B60000
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B60F88
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B6007D
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B6006C
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B60051
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B60FB9
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B600AE
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B60F5C
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B60F41
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B600DA
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00B600F5
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00B60040
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00B60FE5
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00B60F77
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00B60FCA
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00B6001B
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00B600BF
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00B5002C
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00B50062
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00B5001B
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00B50FDB
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00B50FA5
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00B50000
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00B50FC0
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [D5, 88] {AAD 0x88}
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00B50047
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00B4005A
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!system 77C293C7 5 Bytes JMP 00B40049
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00B40FE3
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00B40000
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00B40038
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00B4001D
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00700FE5
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00700F55
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0070004A
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00700F70
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00700F8D
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00700FAF
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 0070006C
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0070005B
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00700EE7
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00700EF8
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 007000A5
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00700F9E
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00700000
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00700F30
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0070001B
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00700FCA
.text C:\WINDOWS\System32\svchost.exe[900] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00700F09
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 006F0FCA
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 006F0F83
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 006F0011
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 006F0FE5
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 006F0036
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 006F0000
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 006F0F9E
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [8F, 88]
.text C:\WINDOWS\System32\svchost.exe[900] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 006F0FB9
.text C:\WINDOWS\System32\svchost.exe[900] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 006E0F6E
.text C:\WINDOWS\System32\svchost.exe[900] msvcrt.dll!system 77C293C7 5 Bytes JMP 006E0F7F
.text C:\WINDOWS\System32\svchost.exe[900] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 006E0FAB
.text C:\WINDOWS\System32\svchost.exe[900] msvcrt.dll!_open 77C2F566 5 Bytes JMP 006E0FEF
.text C:\WINDOWS\System32\svchost.exe[900] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 006E0F90
.text C:\WINDOWS\System32\svchost.exe[900] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 006E0FC6
.text C:\WINDOWS\System32\svchost.exe[900] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006D0FEF
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00070FEF
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00070F70
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00070065
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0007004A
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00070F8D
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0007002F
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 000700AE
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00070091
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateProcessW 7C802336 1 Byte [E9]
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00070F3A
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 000700D3
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 000700E4
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00070FA8
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00070FDE
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00070080
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0007001E
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00070FCD
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070F55
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00060FDB
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00060076
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0006002C
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0006001B
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0006005B
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00060000
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00060FAF
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [26, 88]
.text C:\WINDOWS\system32\services.exe[936] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00060FC0
.text C:\WINDOWS\system32\services.exe[936] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00050027
.text C:\WINDOWS\system32\services.exe[936] msvcrt.dll!system 77C293C7 5 Bytes JMP 00050F9C
.text C:\WINDOWS\system32\services.exe[936] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00050FD2
.text C:\WINDOWS\system32\services.exe[936] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00050000
.text C:\WINDOWS\system32\services.exe[936] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00050FC1
.text C:\WINDOWS\system32\services.exe[936] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00050FE3
.text C:\WINDOWS\system32\services.exe[936] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00040FEF
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E40FEF
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E4006C
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E40F81
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E4005B
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E4004A
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E40FC3
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E400A9
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E40098
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E400E6
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E400CB
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00E40101
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00E40FA8
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00E40FDE
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00E40087
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00E40025
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00E4000A
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00E400BA
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00E30FCA
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00E30065
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00E30FDB
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00E30011
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00E3004A
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00E30000
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00E30FA8
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [03, 89]
.text C:\WINDOWS\system32\lsass.exe[948] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00E30FB9
.text C:\WINDOWS\system32\lsass.exe[948] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C60042
.text C:\WINDOWS\system32\lsass.exe[948] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C60031
.text C:\WINDOWS\system32\lsass.exe[948] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C6000C
.text C:\WINDOWS\system32\lsass.exe[948] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C60FEF
.text C:\WINDOWS\system32\lsass.exe[948] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C60FC1
.text C:\WINDOWS\system32\lsass.exe[948] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C60FD2
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BD0FEF
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 025B0FEF
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 025B0F44
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 025B0F55
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 025B0F70
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 025B002F
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 025B0014
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 025B006F
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 025B0F27
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 025B0EFB
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 025B008A
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 025B00AF
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 025B0F97
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 025B0FD4
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 025B0054
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 025B0FA8
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 025B0FB9
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 025B0F16
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 025A0047
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 025A0FC7
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 025A002C
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 025A001B
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 025A0084
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 025A000A
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 025A0073
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 025A0062
.text C:\WINDOWS\system32\svchost.exe[1144] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 02590FA8
.text C:\WINDOWS\system32\svchost.exe[1144] msvcrt.dll!system 77C293C7 5 Bytes JMP 02590033
.text C:\WINDOWS\system32\svchost.exe[1144] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 02590011
.text C:\WINDOWS\system32\svchost.exe[1144] msvcrt.dll!_open 77C2F566 5 Bytes JMP 02590000
.text C:\WINDOWS\system32\svchost.exe[1144] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 02590022
.text C:\WINDOWS\system32\svchost.exe[1144] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 02590FE3
.text C:\WINDOWS\system32\svchost.exe[1144] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02580000
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CC0000
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CC0F94
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CC0FA5
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CC0FB6
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CC0069
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CC0047
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CC00C1
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CC0F79
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CC0F32
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CC0F4D
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CC00DC
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CC0058
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CC0011
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CC00A4
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CC0036
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CC0FDB
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CC0F68
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CB0FDB
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CB0084
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CB002C
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CB0011
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CB0073
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CB0000
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00CB0062
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CB0047
.text C:\WINDOWS\system32\svchost.exe[1212] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00CA0FB9
.text C:\WINDOWS\system32\svchost.exe[1212] msvcrt.dll!system 77C293C7 5 Bytes JMP 00CA0FCA
.text C:\WINDOWS\system32\svchost.exe[1212] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00CA003A
.text C:\WINDOWS\system32\svchost.exe[1212] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00CA000C
.text C:\WINDOWS\system32\svchost.exe[1212] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00CA0FE5
.text C:\WINDOWS\system32\svchost.exe[1212] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00CA0029
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C9000A
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 07C80000
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 07C800A9
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 07C80098
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 07C80087
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 07C80076
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 07C80040
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 07C800C4
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 07C80F7C
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 07C80F46
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 07C80F57
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 07C80104
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 07C8005B
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 07C80FEF
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 07C80F99
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 07C80FD4
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 07C8001B
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 07C800D5
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 07C7002C
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 07C70065
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 07C70FE5
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 07C70011
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 07C70FA8
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 07C70000
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 07C70FB9
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [E7, 8F] {OUT 0x8f, EAX}
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 07C70FCA
.text C:\WINDOWS\System32\svchost.exe[1252] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 07C60042
.text C:\WINDOWS\System32\svchost.exe[1252] msvcrt.dll!system 77C293C7 5 Bytes JMP 07C60031
.text C:\WINDOWS\System32\svchost.exe[1252] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 07C60FC8
.text C:\WINDOWS\System32\svchost.exe[1252] msvcrt.dll!_open 77C2F566 5 Bytes JMP 07C6000C
.text C:\WINDOWS\System32\svchost.exe[1252] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 07C60FB7
.text C:\WINDOWS\System32\svchost.exe[1252] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 07C60FE3
.text C:\WINDOWS\System32\svchost.exe[1252] WS2_32.dll!socket 71AB4211 5 Bytes JMP 07C50000
.text C:\WINDOWS\System32\svchost.exe[1252] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 07C40000
.text C:\WINDOWS\System32\svchost.exe[1252] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 07C4001B
.text C:\WINDOWS\System32\svchost.exe[1252] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 07C4002C
.text C:\WINDOWS\System32\svchost.exe[1252] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 07C40FDB
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00800000
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00800F92
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00800087
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00800076
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00800065
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00800FB9
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 008000B6
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00800F70
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 008000F6
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00800F53
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00800F42
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00800040
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00800FEF
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00800F81
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00800025
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00800FD4
.text C:\WINDOWS\system32\svchost.exe[1300] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 008000C7
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 007F0033
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 007F0084
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 007F0022
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 007F0011
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 007F0073
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 007F0000
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 007F0FC7
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [9F, 88]
.text C:\WINDOWS\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 007F004E
.text C:\WINDOWS\system32\svchost.exe[1300] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 007E0F90
.text C:\WINDOWS\system32\svchost.exe[1300] msvcrt.dll!system 77C293C7 5 Bytes JMP 007E0FA1
.text C:\WINDOWS\system32\svchost.exe[1300] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 007E0FC3
.text C:\WINDOWS\system32\svchost.exe[1300] msvcrt.dll!_open 77C2F566 5 Bytes JMP 007E0FEF
.text C:\WINDOWS\system32\svchost.exe[1300] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 007E0FB2
.text C:\WINDOWS\system32\svchost.exe[1300] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 007E0FDE
.text C:\WINDOWS\system32\svchost.exe[1300] WS2_32.dll!socket 71AB4211 5 Bytes JMP 007D0FEF
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C10FE5
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C10F43
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C10F54
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C10F6F
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C1002C
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C10F94
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C10089
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C1006E
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C100B5
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C10F1C
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C100D0
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C1001B
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C10FCA
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C10053
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C10FAF
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C10000
.text C:\WINDOWS\system32\svchost.exe[1372] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C1009A
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C0002C
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C00F8D
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C00011
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C00FDB
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C00F9E
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C00000
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00C00FAF
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [E0, 88] {LOOPNZ 0xffffffffffffff8a}
.text C:\WINDOWS\system32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C00FC0
.text C:\WINDOWS\system32\svchost.exe[1372] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BF0F8B
.text C:\WINDOWS\system32\svchost.exe[1372] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BF0F9C
.text C:\WINDOWS\system32\svchost.exe[1372] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BF0FD2
.text C:\WINDOWS\system32\svchost.exe[1372] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BF0FE3
.text C:\WINDOWS\system32\svchost.exe[1372] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BF0FC1
.text C:\WINDOWS\system32\svchost.exe[1372] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BF0000
.text C:\WINDOWS\system32\svchost.exe[1372] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00700FEF
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00700F5E
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00700F6F
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00700F8A
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00700FA5
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00700FCA
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00700F15
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00700F3C
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00700EF3
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00700F04
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00700ED8
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00700047
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0070000A
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00700F4D
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00700036
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0070001B
.text C:\WINDOWS\System32\svchost.exe[1488] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00700082
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 006F0FA8
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 006F0028
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 006F0FB9
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 006F0FD4
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 006F0F6B
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 006F0FEF
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 006F0F86
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [8F, 88]
.text C:\WINDOWS\System32\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 006F0F97
.text C:\WINDOWS\System32\svchost.exe[1488] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 006E0F90
.text C:\WINDOWS\System32\svchost.exe[1488] msvcrt.dll!system 77C293C7 5 Bytes JMP 006E0FA1
.text C:\WINDOWS\System32\svchost.exe[1488] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 006E0011
.text C:\WINDOWS\System32\svchost.exe[1488] msvcrt.dll!_open 77C2F566 5 Bytes JMP 006E0000
.text C:\WINDOWS\System32\svchost.exe[1488] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 006E0FC6
.text C:\WINDOWS\System32\svchost.exe[1488] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 006E0FD7
.text C:\WINDOWS\System32\svchost.exe[1488] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006D0000
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F50FEF
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F50071
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F50F7C
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F50F97
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F5004A
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F50FC3
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F50F3A
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F50082
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F50F0E
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F500A7
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F50EF3
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F50FB2
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F50FDE
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F50F61
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F50025
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F50014
.text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F50F29
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F40FD4
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F40F7C
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F40FE5
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F4001B
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F40F8D
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F40000
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F40FA8
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [14, 89] {ADC AL, 0x89}
.text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F40FC3
.text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F30FAD
.text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F30038
.text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F30027
.text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F30FE3
.text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F30FC8
.text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F30000
.text C:\WINDOWS\system32\svchost.exe[1624] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F20FEF
.text C:\WINDOWS\system32\SearchIndexer.exe[1916] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00DE000A
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00DE0F77
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00DE0F92
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00DE0FA3
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00DE006C
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00DE0040
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00DE00BF
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00DE00A4
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00DE00D0
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00DE0F37
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00DE00E1
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00DE005B
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00DE0FEF
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00DE0087
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00DE002F
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00DE0FDE
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00DE0F5C
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CD0025
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CD006C
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CD000A
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CD0FD4
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CD0051
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CD0FE5
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00CD0FA5
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ED, 88]
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CD0036
.text C:\WINDOWS\system32\svchost.exe[1988] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00CC0F9A
.text C:\WINDOWS\system32\svchost.exe[1988] msvcrt.dll!system 77C293C7 5 Bytes JMP 00CC0FAB
.text C:\WINDOWS\system32\svchost.exe[1988] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00CC0000
.text C:\WINDOWS\system32\svchost.exe[1988] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00CC0FEF
.text C:\WINDOWS\system32\svchost.exe[1988] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00CC001B
.text C:\WINDOWS\system32\svchost.exe[1988] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00CC0FC6
.text C:\WINDOWS\system32\svchost.exe[1988] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 00CA000A
.text C:\WINDOWS\system32\svchost.exe[1988] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 00CA0FEF
.text C:\WINDOWS\system32\svchost.exe[1988] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 00CA0FD4
.text C:\WINDOWS\system32\svchost.exe[1988] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 00CA0FB9
.text C:\WINDOWS\system32\svchost.exe[1988] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CB0000
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00250000
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00250F8F
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00250FA0
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0025007A
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00250069
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0025003D
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00250F46
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00250F6D
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 002500A9
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00250F1A
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 002500C4
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00250058
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00250011
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00250F7E
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00250022
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00250FDB
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00250F2B
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00340FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00340F6F
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0034000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00340FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0034002C
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00340FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0034001B
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00340F94
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9521 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DCB69 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED3AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2543F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E3C10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E3B42 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E3BAD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E3A13 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E3A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E3C73 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E3AD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0035003D
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] msvcrt.dll!system 77C293C7 5 Bytes JMP 0035002C
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00350011
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00350000
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00350FB2
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00350FE3
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED408 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E3F78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 018C000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 018C0FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 018C0FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 018C0FC3
.text C:\Program Files\Internet Explorer\iexplore.exe[2020] ws2_32.dll!socket 71AB4211 5 Bytes JMP 023C0FE5
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 036A0FEF
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 036A006C
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 036A0F6D
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 036A0051
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 036A0040
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 036A0FA8
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 036A0F1A
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 036A0F35
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 036A0ED3
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 036A0EF8
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 036A0087
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 036A0025
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 036A0FD4
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 036A0F52
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 036A0014
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 036A0FC3
.text C:\WINDOWS\Explorer.EXE[3136] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 036A0F09
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 3 Bytes JMP 03690FCA
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyExW + 4 77DD6AB3 1 Byte [8B]
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegCreateKeyExW 77DD776C 3 Bytes JMP 0369005B
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegCreateKeyExW + 4 77DD7770 1 Byte [8B]
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyExA 77DD7852 3 Bytes JMP 03690FDB
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyExA + 4 77DD7856 1 Byte [8B]
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyW 77DD7946 3 Bytes JMP 03690011
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyW + 4 77DD794A 1 Byte [8B]
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 3 Bytes JMP 0369004A
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegCreateKeyExA + 4 77DDE9F8 1 Byte [8B]
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 3 Bytes JMP 03690000
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegOpenKeyA + 4 77DDEFCC 1 Byte [8B]
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 03690FA8
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [89, 8B]
.text C:\WINDOWS\Explorer.EXE[3136] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 03690FB9
.text C:\WINDOWS\Explorer.EXE[3136] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 03400036
.text C:\WINDOWS\Explorer.EXE[3136] msvcrt.dll!system 77C293C7 5 Bytes JMP 03400FAB
.text C:\WINDOWS\Explorer.EXE[3136] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 03400FC6
.text C:\WINDOWS\Explorer.EXE[3136] msvcrt.dll!_open 77C2F566 5 Bytes JMP 03400000
.text C:\WINDOWS\Explorer.EXE[3136] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 03400011
.text C:\WINDOWS\Explorer.EXE[3136] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 03400FD7
.text C:\WINDOWS\Explorer.EXE[3136] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 00DD0FEF
.text C:\WINDOWS\Explorer.EXE[3136] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 00DD0FD4
.text C:\WINDOWS\Explorer.EXE[3136] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 00DD0FC3
.text C:\WINDOWS\Explorer.EXE[3136] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 00DD0014
.text C:\WINDOWS\Explorer.EXE[3136] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02FD0000
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00250FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0025006C
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0025005B
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00250F81
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00250040
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0025002F
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 002500A2
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00250087
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 002500CE
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00250F35
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00250F10
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00250F9E
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0025000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00250F5C
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00250FC3
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00250FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 002500BD
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00340000
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00340047
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00340FAF
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00340FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00340F8A
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00340FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0034002C
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0034001B
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9521 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DCB69 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED3AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2543F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E3C10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E3B42 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E3BAD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E3A13 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E3A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E3C73 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E3AD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00350FB4
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] msvcrt.dll!system 77C293C7 5 Bytes JMP 00350049
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0035001D
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00350000
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0035002E
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00350FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED408 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E3F78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 01BF0000
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 01BF001B
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 01BF0FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 01BF0FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[3676] ws2_32.dll!socket 71AB4211 5 Bytes JMP 024D0FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00250000
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00250F63
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00250F7E
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00250F9B
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00250058
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00250FC0
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00250F28
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0025007A
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 002500C1
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 002500A6
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00250F0D
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0025003D
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00250FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00250069
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0025002C
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0025001B
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 0025008B
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00340036
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00340058
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0034001B
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00340FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00340FA5
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00340000
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00340FB6
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [54, 88]
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00340047
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9521 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DCB69 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED3AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2543F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E3C10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E3B42 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E3BAD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E3A13 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E3A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E3C73 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E3AD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00350058
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] msvcrt.dll!system 77C293C7 5 Bytes JMP 0035003D
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00350011
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00350FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0035002C
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00350000
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED408 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E3F78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 01BF0FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 01BF0000
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 01BF0025
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 01BF0FCA
.text C:\Program Files\Internet Explorer\iexplore.exe[4184] ws2_32.dll!socket 71AB4211 5 Bytes JMP 024D0000
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00260FEF
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00260F8D
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00260F9E
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00260078
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00260FAF
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00260FCA
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 002600BA
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00260F68
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00260F4D
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 002600E6
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00260F28
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00260051
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00260000
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00260093
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00260036
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00260011
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 002600D5
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00350FB9
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00350076
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0035000A
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00350FD4
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0035005B
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00350FEF
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00350040
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0035002F
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0036001D
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] msvcrt.dll!system 77C293C7 5 Bytes JMP 00360F9C
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00360FB7
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00360FEF
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0036000C
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00360FDE
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 00370FEF
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 00370014
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 00370FDE
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 0037002F
.text C:\PROGRA~1\WINZIP\winzip32.exe[4668] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01060000
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E9000A
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E90FBD
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E900B2
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E90095
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E90084
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E9004E
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E900EA
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E90FA2
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E9010C
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E900FB
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00E90F62
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00E90069
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00E9001B
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00E900CD
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00E9003D
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00E9002C
.text C:\WINDOWS\system32\wuauclt.exe[4684] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00E90F87
.text C:\WINDOWS\system32\wuauclt.exe[4684] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E7007A
.text C:\WINDOWS\system32\wuauclt.exe[4684] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E70069
.text C:\WINDOWS\system32\wuauclt.exe[4684] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E70033
.text C:\WINDOWS\system32\wuauclt.exe[4684] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E70FEF
.text C:\WINDOWS\system32\wuauclt.exe[4684] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E7004E
.text C:\WINDOWS\system32\wuauclt.exe[4684] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E7000C
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00E80047
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00E80FA5
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00E80022
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00E80011
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00E80FC0
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00E80000
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00E80FDB
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [08, 89]
.text C:\WINDOWS\system32\wuauclt.exe[4684] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00E80058
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02180FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02180F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0218004F
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02180F75
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02180028
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02180F97
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 0218007B
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 02180F35
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02180F07
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02180096
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 02180EF6
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 02180F86
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 02180FDE
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 02180060
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02180FA8
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 02180FCD
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 02180F18
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 02170FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0217005E
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 02170FCA
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 02170FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 02170F97
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 02170000
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 02170FA8
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [37, 8A]
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 02170025
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED3AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E3C10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E3B42 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E3BAD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E3A13 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E3A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E3C73 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E3AD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 02160F8D
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] msvcrt.dll!system 77C293C7 5 Bytes JMP 02160018
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 02160FC3
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] msvcrt.dll!_open 77C2F566 5 Bytes JMP 02160FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 02160FB2
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 02160FDE
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 0214000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 02140FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 02140FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 02140FC3
.text C:\Program Files\Internet Explorer\iexplore.exe[5416] ws2_32.dll!socket 71AB4211 5 Bytes JMP 02150FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00250000
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00250F68
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00250053
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00250F79
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00250F8A
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00250FC0
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00250F35
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00250F46
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00250EF5
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00250098
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00250EE4
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00250FA5
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00250011
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00250F57
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00250FDB
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0025002C
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00250F24
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0034003D
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00340FB3
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00340022
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00340011
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00340070
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00340000
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0034005F
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0034004E
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9521 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DCB69 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED3AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2543F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E3C10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E3B42 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E3BAD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E3A13 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E3A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E3C73 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E3AD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00350FAD
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] msvcrt.dll!system 77C293C7 5 Bytes JMP 00350042
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0035000C
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00350FE3
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0035001D
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00350FD2
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED408 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E3F78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] WININET.dll!InternetOpenA 3D95D688 5 Bytes JMP 018D000A
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] WININET.dll!InternetOpenW 3D95DB01 5 Bytes JMP 018D0025
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] WININET.dll!InternetOpenUrlA 3D95F39C 5 Bytes JMP 018D0036
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] WININET.dll!InternetOpenUrlW 3D9A6F37 5 Bytes JMP 018D0051
.text C:\Program Files\Internet Explorer\iexplore.exe[6064] ws2_32.dll!socket 71AB4211 5 Bytes JMP 023B0FEF

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Program Files\Internet Explorer\iexplore.exe[2020] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[3676] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [ADVAPI32.dll!RegQueryValueA] 003AB390
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [ADVAPI32.dll!RegCreateKeyExW] 003AB1A3
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] 003A6BCE
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] 003A77A7
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CloseHandle] 003A9551
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FreeLibrary] 003A7F73
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] 003A798C
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateFileW] 003A8DCC
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GlobalUnlock] 003AAA37
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GlobalLock] 003AAA67
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcessHeap] 003AB5AA
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FindFirstFileW] 003AA791
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!DuplicateHandle] 003A94E1
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread] 003A8633
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] 003A7D87
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetEnvironmentStringsW] 003A82CF
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!IsDebuggerPresent] 003AB8D6
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!ReadFile] 003A8FCB
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetFilePointer] 003A93DD
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!MapViewOfFileEx] 003A9B20
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateFileMappingW] 003A9810
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!MapViewOfFile] 003A9ACE
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!OpenFileMappingW] 003AA10D
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!UnmapViewOfFile] 003A9C18
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] 003A7B9B
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!TerminateProcess] 003A8588
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GlobalAlloc] 003AAB12
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FlushViewOfFile] 003A98D2
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetFileSize] 003A9494
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!WriteFile] 003A9208
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetFileType] 003A95E1
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetACP] 003AB5B6
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateFileMappingA] 003A97A7
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadIconW] 003AB73B
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadCursorW] 003AB709
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!CreateDialogParamW] 003AB85E
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!DialogBoxParamW] 003AB8BA
IAT C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe[3880] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadStringW] 003AB7A7
IAT C:\Program Files\Internet Explorer\iexplore.exe[4184] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[6064] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Roxio)

—- EOF - GMER 1.0.15 —-