www.domredi.com/1/ Home Page Change

Hi,



My name is NoodleTech. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

As I'm still in training at What The Tech, all my posts needs to be checked by an expert first. This may cause a delay, but I will do my best to keep it as short as possible.

Hi gtbear,

Please do the following:

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\Fonts\*.com
  %systemroot%\Fonts\*.dll
  %systemroot%\Fonts\*.ini
  %systemroot%\Fonts\*.ini2
  %systemroot%\Fonts\*.exe
  %systemroot%\system32\spool\prtprocs\w32x86\*.*
  %systemroot%\REPAIR\*.bak1
  %systemroot%\REPAIR\*.ini
  %systemroot%\system32\*.jpg
  %systemroot%\*.jpg
  %systemroot%\*.png
  %systemroot%\*.scr
  %systemroot%\*._sy
  %APPDATA%\Adobe\Update\*.*
  %ALLUSERSPROFILE%\Favorites\*.*
  %APPDATA%\Microsoft\*.*
  %PROGRAMFILES%\*.*
  %APPDATA%\Update\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\System32\config\*.sav
  %PROGRAMFILES%\bak. /s
  %systemroot%\system32\bak. /s
  %ALLUSERSPROFILE%\Start Menu\*.lnk /x
  %systemroot%\system32\config\systemprofile\*.dat /x
  %systemroot%\*.config
  %systemroot%\system32\*.db
  %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
  %USERPROFILE%\Desktop\*.exe
  %PROGRAMFILES%\Common Files\*.*
  %systemroot%\*.src
  %systemroot%\install\*.*
  %systemroot%\system32\DLL\*.*
  %systemroot%\system32\HelpFiles\*.*
  %systemroot%\system32\rundll\*.*
  %systemroot%\winn32\*.*
  %systemroot%\Java\*.*
  %systemroot%\system32\test\*.*
  %systemroot%\system32\Rundll32\*.*
  %systemroot%\AppPatch\Custom\*.*
  %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
  %PROGRAMFILES%\PC-Doctor\Downloads\*.*
  %PROGRAMFILES%\Internet Explorer\*.tmp
  %PROGRAMFILES%\Internet Explorer\*.dat
  %USERPROFILE%\My Documents\*.exe
  %USERPROFILE%\*.exe
  %systemroot%\ADDINS\*.*
  %systemroot%\assembly\*.bak2
  %systemroot%\Config\*.*
  %systemroot%\REPAIR\*.bak2
  %systemroot%\SECURITY\Database\*.sdb /x
  %systemroot%\SYSTEM\*.bak2
  %systemroot%\Web\*.bak2
  %systemroot%\Driver Cache\*.*
  %PROGRAMFILES%\Mozilla Firefox\0*.exe
  %ProgramFiles%\Microsoft Common\*.*
  %ProgramFiles%\TinyProxy.
  %USERPROFILE%\Favorites\*.url /x
  %systemroot%\system32\*.bk
  %systemroot%\*.te
  %systemroot%\system32\system32\*.*
  %ALLUSERSPROFILE%\*.dat /x
  %systemroot%\system32\drivers\*.rmv
  dir /b "%systemroot%\system32\*.exe" | find /i " " /c
  dir /b "%systemroot%\*.exe" | find /i " " /c
  %PROGRAMFILES%\Microsoft\*.*
  %systemroot%\System32\Wbem\proquota.exe
  %PROGRAMFILES%\Mozilla Firefox\*.dat
  %USERPROFILE%\Cookies\*.txt /x
  %SystemRoot%\system32\fonts\*.*
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

===================================================

Please download MBRCheck.exe to your desktop.

• Be sure to disable your security programs
• Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
• A window will open on your desktop
• if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
• If nothing unusual is found just press Enter
• A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
• Please post the contents of that file.

===================================================

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

In your next post, please include the following:

• OTL log
• MBRCheck log
• GMER log

Here's the MBRCheck Sadly, I was unable to turn off Sophos MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x03c0101d Kernel Drivers (total 119): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806E5000 \WINDOWS\system32\hal.dll 0xB85A8000 \WINDOWS\system32\KDCOM.DLL 0xB84B8000 \WINDOWS\system32\BOOTVID.dll 0xB7F79000 ACPI.sys 0xB85AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xB7F68000 pci.sys 0xB80A8000 isapnp.sys 0xB8670000 pciide.sys 0xB8328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xB80B8000 MountMgr.sys 0xB7F49000 ftdisk.sys 0xB85AC000 dmload.sys 0xB7F23000 dmio.sys 0xB8330000 PartMgr.sys 0xB80C8000 VolSnap.sys 0xB7F0B000 atapi.sys 0xB7E31000 iaStor.sys 0xB80D8000 disk.sys 0xB80E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xB7E11000 fltMgr.sys 0xB7DFF000 sr.sys 0xB80F8000 PxHelp20.sys 0xB7DE8000 KSecDD.sys 0xB7D5B000 Ntfs.sys 0xB7D2E000 NDIS.sys 0xB8108000 sfaudio.sys 0xB7D14000 Mup.sys 0xB8268000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xB8564000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0xB7787000 \SystemRoot\system32\DRIVERS\ati2mtag.sys 0xB7773000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xB8278000 \SystemRoot\system32\DRIVERS\HECI.sys 0xB8288000 \SystemRoot\system32\DRIVERS\serial.sys 0xB8568000 \SystemRoot\system32\DRIVERS\serenum.sys 0xB774E000 \SystemRoot\system32\DRIVERS\e1k5132.sys 0xB83D0000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xB772A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xB83D8000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xB7702000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xB83E0000 \SystemRoot\system32\DRIVERS\fdc.sys 0xB76EE000 \SystemRoot\system32\DRIVERS\parport.sys 0xB8755000 \SystemRoot\system32\DRIVERS\DamewareMini.sys 0xB8298000 \SystemRoot\system32\DRIVERS\dwvkbd.sys 0xB83E8000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xB8757000 \SystemRoot\system32\DRIVERS\audstub.sys 0xB82A8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xB856C000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xB76D7000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xB82B8000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xB82C8000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xB83F0000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xB76C6000 \SystemRoot\system32\DRIVERS\psched.sys 0xB82D8000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xB83F8000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xB8400000 \SystemRoot\system32\DRIVERS\raspti.sys 0xB7696000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xB82E8000 \SystemRoot\system32\DRIVERS\termdd.sys 0xB8408000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xB85C6000 \SystemRoot\system32\DRIVERS\swenum.sys 0xB764B000 \SystemRoot\system32\DRIVERS\ks.sys 0xB75ED000 \SystemRoot\system32\DRIVERS\update.sys 0xB8584000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xB8318000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xB8128000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xB85D0000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xAB48C000 \SystemRoot\system32\drivers\ADIHdAud.sys 0xAB468000 \SystemRoot\system32\drivers\portcls.sys 0xB8138000 \SystemRoot\system32\drivers\drmk.sys 0xB8428000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xB8430000 \SystemRoot\system32\DRIVERS\savonaccessfilter.sys 0xAB442000 \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys 0xB85E8000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xB87BD000 \SystemRoot\System32\Drivers\Null.SYS 0xB85EA000 \SystemRoot\System32\Drivers\Beep.SYS 0xB8440000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xB8448000 \SystemRoot\System32\drivers\vga.sys 0xB85EC000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xB85EE000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xB8450000 \SystemRoot\System32\Drivers\Msfs.SYS 0xB8458000 \SystemRoot\System32\Drivers\Npfs.SYS 0xB8558000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xAB3E7000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xAB38E000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xAB366000 \SystemRoot\system32\DRIVERS\netbt.sys 0xAB340000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xAB31E000 \SystemRoot\System32\drivers\afd.sys 0xB8178000 \SystemRoot\system32\DRIVERS\netbios.sys 0xB8188000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xAB2F3000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xAB283000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xB81B8000 \SystemRoot\System32\Drivers\Fips.SYS 0xB7672000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xB81D8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xAB59F000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xBF800000 \SystemRoot\System32\win32k.sys 0xAB587000 \SystemRoot\System32\drivers\Dxapi.sys 0xB8480000 \SystemRoot\System32\watchdog.sys 0xBD000000 \SystemRoot\System32\drivers\dxg.sys 0xB86CF000 \SystemRoot\System32\drivers\dxgthk.sys 0xBD012000 \SystemRoot\System32\ati2dvag.dll 0xBD063000 \SystemRoot\System32\ati2cqag.dll 0xBD0F0000 \SystemRoot\System32\atikvmag.dll 0xBD163000 \SystemRoot\System32\atiok3x2.dll 0xBD1AD000 \SystemRoot\System32\ati3duag.dll 0xBD59B000 \SystemRoot\System32\ativvaxx.dll 0xBD7FD000 \SystemRoot\System32\ATMFD.DLL 0xA8CEF000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xA8B2F000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xA88A7000 \SystemRoot\system32\DRIVERS\srv.sys 0xB8498000 \SystemRoot\System32\Drivers\TDTCP.SYS 0xA8244000 \SystemRoot\System32\Drivers\RDPWD.SYS 0xA8167000 \SystemRoot\system32\drivers\wdmaud.sys 0xA874F000 \SystemRoot\system32\drivers\sysaudio.sys 0xA7BF8000 \SystemRoot\System32\Drivers\HTTP.sys 0xA6C52000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xA6C46000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xA5E05000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 48): 0 System Idle Process 4 System 648 D:\WINDOWS\system32\smss.exe 704 csrss.exe 736 D:\WINDOWS\system32\winlogon.exe 780 D:\WINDOWS\system32\services.exe 792 D:\WINDOWS\system32\lsass.exe 996 D:\WINDOWS\system32\ati2evxx.exe 1020 D:\WINDOWS\system32\svchost.exe 1088 svchost.exe 1188 D:\WINDOWS\system32\svchost.exe 1640 svchost.exe 1696 svchost.exe 1816 D:\WINDOWS\system32\spoolsv.exe 1900 svchost.exe 1976 D:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe 180 D:\WINDOWS\dwrcs\DWRCS.EXE 264 D:\Program Files\Java\jre6\bin\jqs.exe 372 D:\Program Files\Intel\AMT\LMS.exe 468 D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 560 D:\WINDOWS\system32\svchost.exe 692 D:\WINDOWS\system32\svchost.exe 1540 D:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe 2228 D:\Program Files\Sophos\AutoUpdate\ALsvc.exe 2316 D:\Program Files\Sophos\Remote Management System\RouterNT.exe 2364 D:\WINDOWS\system32\svchost.exe 2592 D:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe 2868 D:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe 3216 alg.exe 3868 SavService.exe 3384 D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe 3704 swi_service.exe 2756 D:\WINDOWS\dwrcs\DWRCST.EXE 1360 D:\WINDOWS\system32\ati2evxx.exe 5708 D:\WINDOWS\explorer.exe 4956 D:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe 5868 D:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe 4292 D:\Program Files\Analog Devices\Core\smax4pnp.exe 4504 D:\Program Files\Documentum\AppConnector\Documentum.AppConnector.CredentialManager.exe 3740 D:\Program Files\Sophos\AutoUpdate\ALMon.exe 5476 D:\Program Files\Google\Gmail Notifier\gnotify.exe 4284 D:\Documents and Settings\ucyzdun\Local Settings\Application Data\gersai.exe 5912 D:\WINDOWS\system32\ctfmon.exe 5312 D:\Program Files\MMTaskbar\MultiMon.exe 5316 D:\Program Files\PrintKey2000\Printkey2000.exe 1060 D:\Documents and Settings\ucyzdun\Desktop\OTL.exe 4936 D:\Program Files\Internet Explorer\iexplore.exe 192 D:\Documents and Settings\ucyzdun\Local Settings\Temporary Internet Files\Content.IE5\RTAIYC6D\MBRCheck[1].exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000007`cfcadc00 (NTFS) \\.\E: –> \\.\PhysicalDrive0 at offset 0x00000026`5f708800 (NTFS) PhysicalDrive0 Model Number: ST3250318AS, Rev: CC46 Size Device Name MBR Status ——————————————– 232 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done!

Hi, The GMER scan keeps crashing my system. Everything locks up or I lose my icons and startbar. Regards David

Hi gtbear,

Run OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  O4 - HKLM..\Run: [hpgcrybc] D:\Documents and Settings\ucyzdun\Local Settings\Application Data\gersai.exe ()
  O4 - HKCU..\Run: [hpgcrybc] D:\Documents and Settings\ucyzdun\Local Settings\Application Data\gersai.exe ()
  O4 - Startup: D:\Documents and Settings\ucyzdun\Start Menu\Programs\Startup\frilm.exe ()
  O4 - Startup: D:\Documents and Settings\ucyzdun\Start Menu\Programs\Startup\peyci.exe ()
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://domredi.com/1/
  
  :Commands
  [createrestorepoint]
  [purity]
  [emptytemp]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

===================================================

Next, I need you to run Malwarebytes Antimalware.

• Click the Update tab then click Check for Updates.
• If an update is found, it will download and install the latest version.
• Next, click the Scanner tab and select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

===================================================

Scan With RootKitUnHooker

• Please choose one link and download Rootkit Unhooker and save it to your desktop.
  Link 1
  Link 2
  Link 3
  
• Now double-click on RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan.
• Check (Tick) Drivers and Stealth
• Uncheck the rest. then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished and then click File > Save Report.
• Save the report somewhere where you can find it. Click Close.
• Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

===================================================

In your next post, please post the following:

• OTL log
• MBAM log
• Rootkit Unhooker log

The Malware scan was clear. Here's the log Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5987 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 08/03/2011 09:50:46 mbam-log-2011-03-08 (09-50-46).txt Scan type: Quick scan Objects scanned: 306837 Time elapsed: 13 minute(s), 38 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

and here's the rootkit report. RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #2 ============================================== >SSDT State ============================================== ntkrnlpa.exe–>NtCreateKey, Type: Address change 0x806240F0–>A14A83BA [D:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys] ntkrnlpa.exe–>NtCreateThread, Type: Address change 0x805D1018–>A14A88A4 [D:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys] ntkrnlpa.exe–>NtDeleteKey, Type: Address change 0x8062458C–>A14A8510 [D:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys] ntkrnlpa.exe–>NtSetSystemInformation, Type: Address change 0x8060FD06–>A14A8BCE [D:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys] ntkrnlpa.exe–>NtSetValueKey, Type: Address change 0x80622662–>A14A8576 [D:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys] ============================================== >Shadow ============================================== ============================================== >Processes ============================================== 0x8A8A19C8 [4] System 0x8A4DA758 [236] D:\WINDOWS\dwrcs\DWRCS.EXE (DameWare Development LLC, DameWare Mini Remote Client Agent) 0x8A7D3328 [248] D:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe (Sophos Plc, Sophos Agent) 0x89E7E020 [432] D:\WINDOWS\dwrcs\DWRCST.EXE (DameWare Development, DameWare Mini Remote Control User Interface) 0x8A5275F8 [452] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A61E650 [512] D:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe (Sophos Plc, Sophos Administrator Service) 0x89FF85E8 [616] D:\Program Files\Sophos\Remote Management System\RouterNT.exe (Sophos Plc, Sophos Message Router) 0x8A590A88 [648] D:\WINDOWS\system32\smss.exe (Microsoft Corporation, Windows NT Session Manager) 0x8A5DD950 [704] D:\WINDOWS\system32\csrss.exe (Microsoft Corporation, Client Server Runtime Process) 0x8A5D95D0 [736] D:\WINDOWS\system32\winlogon.exe (Microsoft Corporation, Windows NT Logon Application) 0x8A661020 [780] D:\WINDOWS\system32\services.exe (Microsoft Corporation, Services and Controller app) 0x8A5ED6F0 [792] D:\WINDOWS\system32\lsass.exe (Microsoft Corporation, LSA Shell (Export Version)) 0x89957020 [988] D:\Documents and Settings\ucyzdun\Local Settings\Temporary Internet Files\Content.IE5\0RQXLB2M\RKUnhookerLE[1].EXE (UG North, RKULE, SR2 Normandy) 0x8A4D63A8 [1004] D:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc., ATI External Event Utility EXE Module) 0x8A559818 [1028] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A550970 [1052] D:\Program Files\Sophos\AutoUpdate\ALsvc.exe (Sophos Plc, Sophos AutoUpdate Service.) 0x8A665DA0 [1100] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A552390 [1188] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A568BE0 [1252] D:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc., ATI External Event Utility EXE Module) 0x8A525B28 [1284] D:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe (Sophos Plc, Performs virus scanning and disinfection functions) 0x89E01960 [1292] D:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software, -) 0x8A4D8960 [1352] D:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc., Java™ Quick Starter Service) 0x89F91420 [1636] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A4845B8 [1644] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A4C2260 [1672] D:\Program Files\Intel\AMT\LMS.exe (Intel Corporation, Local Manageability Service) 0x8A5636A8 [1700] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A52F420 [1788] D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation, Machine Debug Manager) 0x8A4D2DA0 [1828] D:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App) 0x8A4DF9E0 [1912] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A4C2A28 [1968] D:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8A4986B8 [2004] D:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe (Altiris, Inc., Altiris Agent) 0x89F8EDA0 [2076] D:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe (Sophos Plc, Sophos Web Intelligence) 0x89F8CDA0 [2180] D:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe (Intel Corporation, User Notification Service) 0x89E835A8 [2260] D:\Program Files\Sophos\AutoUpdate\ALMon.exe (Sophos Plc, Sophos Endpoint Security and Control) 0x89F67520 [2328] D:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation, RAID Monitor) 0x898A9DA0 [2448] D:\Program Files\Documentum\AppConnector\EventServer.exe (Documentum, a division of EMC Corporation, Documentum Application Connector Event Server) 0x89EEC3B8 [2632] D:\WINDOWS\explorer.exe (Microsoft Corporation, Windows Explorer) 0x8A531850 [2728] D:\WINDOWS\system32\alg.exe (Microsoft Corporation, Application Layer Gateway Service) 0x89CA0470 [2768] D:\PROGRA~1\BUSINE~2\BUSINE~1.0\WIN32_~1\busobj.exe (Business Objects, Business Objects) 0x8985A7E0 [2952] D:\WINDOWS\system32\notepad.exe (Microsoft Corporation, Notepad) 0x89E303B0 [2976] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation, CTF Loader) 0x89E177D0 [2980] D:\Program Files\MMTaskbar\MultiMon.exe (-, MultiMon MFC Application) 0x89EDD9F0 [3156] D:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation, Internet Explorer) 0x89EEF328 [3512] D:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation, Event Monitor User Notification Tool) 0x89EAF600 [3520] D:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe (Intel Corporation, Intel® Management and Security) 0x89E5D3B8 [3524] D:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc., SMax4PNP) 0x89E9DAA8 [3824] D:\Program Files\Documentum\AppConnector\Documentum.AppConnector.CredentialManager.exe (Documentum, a division of EMC Corporation, Documentum.AppConnector.CredentialManager) 0x89E3E9E0 [4008] D:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation, Microsoft Office Outlook) 0x89EA9DA0 [4068] D:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc., Gmail Notifier) ============================================== >Drivers ============================================== 0xAD6EA000 D:\WINDOWS\system32\DRIVERS\ati2mtag.sys 5455872 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver) 0xBD1AD000 D:\WINDOWS\System32\ati3duag.dll 4120576 bytes (ATI Technologies Inc. , ati3duag.dll) 0xBD59B000 D:\WINDOWS\System32\ativvaxx.dll 2498560 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver) 0x804D7000 D:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2154496 bytes 0x804D7000 RAW 2154496 bytes 0x804D7000 WMIxWDM 2154496 bytes 0xBF800000 Win32k 1855488 bytes 0xBF800000 D:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xB7E31000 iaStor.sys 892928 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32) 0xBD063000 D:\WINDOWS\System32\ati2cqag.dll 577536 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module) 0xB7D5B000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xBD0F0000 D:\WINDOWS\System32\atikvmag.dll 471040 bytes (ATI Technologies Inc., Virtual Command And Memory Manager) 0xA12D6000 D:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xAD578000 D:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xA13E1000 D:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0x9EB52000 D:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xA14DF000 D:\WINDOWS\system32\drivers\ADIHdAud.sys 356352 bytes (Analog Devices, Inc., High Definition Audio Function Driver) 0xBD012000 D:\WINDOWS\System32\ati2dvag.dll 331776 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver) 0xBD163000 D:\WINDOWS\System32\atiok3x2.dll 303104 bytes (ATI Technologies Inc., Ring 0 x2 component) 0xBD7FD000 D:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0x9E1F3000 D:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xAD5F9000 D:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xB7F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xB7D2E000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0x9EE02000 D:\WINDOWS\system32\DRIVERS\mrxdav.sys 180224 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0x9DE08000 D:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xA1346000 D:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xAD665000 D:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xA13B9000 D:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xB7F23000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver) 0xA1393000 D:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xA1495000 D:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys 155648 bytes (Sophos Plc, SAV On-access and HIPS for Windows XP (x86)) 0xAD6B1000 D:\WINDOWS\system32\DRIVERS\e1k5132.sys 151552 bytes (Intel Corporation, Intel® Gigabit Adapter NDIS 5.x driver) 0xA14BB000 D:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xAD68D000 D:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xAD5D6000 D:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0x9E567000 D:\WINDOWS\System32\Drivers\RDPWD.SYS 143360 bytes (Microsoft Corporation, RDP Terminal Stack Driver (US/Canada Only, Not for Export)) 0xA1371000 D:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x806E5000 ACPI_HAL 134400 bytes 0x806E5000 D:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xB7E11000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xB7F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xB7D14000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xB7F0B000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xB7DE8000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xAD63A000 D:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x9E552000 D:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xAD651000 D:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver) 0xAD6D6000 D:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xA143A000 D:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBD000000 D:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xB7DFF000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xB7F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xAD629000 D:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xAEEBB000 D:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xB8148000 D:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xAEECB000 D:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xB8248000 D:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xB80E8000 D:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xB82D8000 D:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xB80C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xB82F8000 D:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xB46E0000 D:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xB80B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xB82E8000 D:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xB8108000 sfaudio.sys 45056 bytes (Sonic Focus, Inc, Sonic Focus DSP driver for ADI) 0xAEE7B000 D:\WINDOWS\system32\DRIVERS\dwvkbd.sys 40960 bytes (DameWare, DameWare Virtual Keyboard Driver) 0xAEE8B000 D:\WINDOWS\system32\DRIVERS\HECI.sys 40960 bytes (Intel Corporation, Intel® Management Engine Interface) 0xB80A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xB8138000 D:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xAEE6B000 D:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xB80D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xB46B0000 D:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library) 0xAEEAB000 D:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xB8308000 D:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xB8188000 D:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0x9E324000 D:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xB80F8000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xB8198000 D:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xB49D3000 D:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xB84A0000 D:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xB8480000 D:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver) 0xB49C3000 D:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xB8328000 D:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xB84B0000 D:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xB8380000 D:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xB8398000 D:\WINDOWS\system32\DRIVERS\savonaccessfilter.sys 24576 bytes (Sophos Plc, SAV On-access and HIPS for Windows XP (x86)) 0xB499B000 D:\WINDOWS\System32\Drivers\TDTCP.SYS 24576 bytes (Microsoft Corporation, TCP Transport Driver) 0xB8498000 D:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xB8488000 D:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xB8390000 D:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver) 0xB8490000 D:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xB8330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xB498B000 D:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xB8408000 D:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xB8340000 D:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xB83E0000 D:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xB8590000 D:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xB7CD3000 D:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0x9EEF6000 D:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xB859C000 D:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xB84B8000 D:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xB2EE7000 D:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xB2ED7000 D:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0xB8594000 D:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xB85A0000 D:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xB856C000 D:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xB8558000 D:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI) 0xB862E000 D:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xB85AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver) 0xB860C000 D:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xB85A8000 D:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xB860E000 D:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xB8610000 D:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xB8624000 D:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xB8628000 D:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xB85AA000 D:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xB87D5000 D:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xB8696000 D:\WINDOWS\system32\DRIVERS\DamewareMini.sys 4096 bytes (DameWare Development, LLC, DameWare Development Mirror Miniport Driver) 0xB8774000 D:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xB86F6000 D:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xB8670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) ============================================== >Stealth ============================================== 0x03630000 Hidden Image–>PrivacyIconClient.resources.dll [ EPROCESS 0x89EAF600 ] PID: 3520, 36864 bytes ============================================== >Files ============================================== ============================================== >Hooks ============================================== ntkrnlpa.exe+0x0002D85C, Type: Inline - RelativeJump 0x8050485C–>805047E7 [ntkrnlpa.exe] ntkrnlpa.exe+0x0006ECEE, Type: Inline - RelativeJump 0x80545CEE–>80545CF5 [ntkrnlpa.exe] [1028]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1028]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1028]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1028]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [1028]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [1028]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1100]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1100]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1100]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [1100]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [1100]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1188]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1188]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1188]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>wininet.dll–>InternetOpenA, Type: Inline - RelativeJump 0x3D953081–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>wininet.dll–>InternetOpenUrlA, Type: Inline - RelativeJump 0x3D956F5A–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>wininet.dll–>InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D951615–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x3D9513D4–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [1188]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [1188]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1636]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1636]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1636]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1636]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1644]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1644]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1644]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [1644]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [1644]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1700]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1700]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1700]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [1700]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [1700]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1912]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1912]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1912]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>wininet.dll–>InternetOpenA, Type: Inline - RelativeJump 0x3D953081–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>wininet.dll–>InternetOpenUrlA, Type: Inline - RelativeJump 0x3D956F5A–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>wininet.dll–>InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D951615–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x3D9513D4–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [1912]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [1912]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [1968]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [1968]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [1968]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [1968]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [1968]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>SetUnhandledExceptionFilter, Type: Inline - RelativeJump 0x7C84495D–>00000000 [MSO.DLL] [2440]EXCEL.EXE–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [2440]EXCEL.EXE–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [2440]EXCEL.EXE–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [2440]EXCEL.EXE–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [2440]EXCEL.EXE–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [2632]explorer.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [2632]explorer.exe–>kernel32.dll–>CopyFileExW, Type: Inline - RelativeJump 0x7C827B32–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>CopyFileExW, Type: Inline - SEH 0x7C827B37 [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>CopyFileExW, Type: Inline - SEH 0x7C827B38 [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x01001268–>00000000 [shimeng.dll] [2632]explorer.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>MoveFileWithProgressW, Type: Inline - RelativeJump 0x7C81F72E–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [2632]explorer.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [2632]explorer.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [2632]explorer.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [2632]explorer.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [2632]explorer.exe–>wininet.dll–>InternetOpenA, Type: Inline - RelativeJump 0x3D953081–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>wininet.dll–>InternetOpenUrlA, Type: Inline - RelativeJump 0x3D956F5A–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>wininet.dll–>InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D951615–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x3D9513D4–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x3D931480–>00000000 [shimeng.dll] [2632]explorer.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll] [2632]explorer.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [2632]explorer.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [2632]explorer.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [2852]HRSMail.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [2852]HRSMail.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77DD1214–>00000000 [aclayers.dll] [2852]HRSMail.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77DD105C–>00000000 [aclayers.dll] [2852]HRSMail.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77DD11E0–>00000000 [aclayers.dll] [2852]HRSMail.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [2852]HRSMail.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77F11084–>00000000 [aclayers.dll] [2852]HRSMail.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77F11078–>00000000 [aclayers.dll] [2852]HRSMail.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77F110B8–>00000000 [aclayers.dll] [2852]HRSMail.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x004AA1DC–>00000000 [shimeng.dll] [2852]HRSMail.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x004AA354–>00000000 [shimeng.dll] [2852]HRSMail.exe–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x004AA2EC–>00000000 [aclayers.dll] [2852]HRSMail.exe–>kernel32.dll–>LoadLibraryExA, Type: IAT modification 0x004AA1D0–>00000000 [aclayers.dll] [2852]HRSMail.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [2852]HRSMail.exe–>shell32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7C9C13E8–>00000000 [aclayers.dll] [2852]HRSMail.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExA, Type: IAT modification 0x7C9C163C–>00000000 [aclayers.dll] [2852]HRSMail.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7C9C161C–>00000000 [aclayers.dll] [2852]HRSMail.exe–>shell32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7C9C15A0–>00000000 [aclayers.dll] [2852]HRSMail.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [2852]HRSMail.exe–>user32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7E4112F4–>00000000 [aclayers.dll] [2852]HRSMail.exe–>user32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7E411208–>00000000 [aclayers.dll] [2852]HRSMail.exe–>user32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7E411340–>00000000 [aclayers.dll] [3156]iexplore.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [3156]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77DD1214–>00000000 [aclayers.dll] [3156]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77DD105C–>00000000 [aclayers.dll] [3156]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77DD11E0–>00000000 [aclayers.dll] [3156]iexplore.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [3156]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77F11084–>00000000 [aclayers.dll] [3156]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77F11078–>00000000 [aclayers.dll] [3156]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77F110B8–>00000000 [aclayers.dll] [3156]iexplore.exe–>kernel32.dll–>CreateActCtxW, Type: Inline - RelativeJump 0x7C8154FC–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>CreateFileW, Type: Inline - RelativeJump 0x7C810800–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [3156]iexplore.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [3156]iexplore.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0040111C–>00000000 [shimeng.dll] [3156]iexplore.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [3156]iexplore.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [3156]iexplore.exe–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x00401060–>00000000 [aclayers.dll] [3156]iexplore.exe–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x004010B8–>00000000 [aclayers.dll] [3156]iexplore.exe–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x00401078–>00000000 [aclayers.dll] [3156]iexplore.exe–>kernel32.dll–>ReplaceFile, Type: Inline - RelativeJump 0x7C836C6C–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [3156]iexplore.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [3156]iexplore.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>mswsock.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71A51178–>00000000 [shimeng.dll] [3156]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71A51184–>00000000 [aclayers.dll] [3156]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x71A511A0–>00000000 [aclayers.dll] [3156]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [3156]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [3156]iexplore.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [3156]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7C9C13E8–>00000000 [aclayers.dll] [3156]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExA, Type: IAT modification 0x7C9C163C–>00000000 [aclayers.dll] [3156]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7C9C161C–>00000000 [aclayers.dll] [3156]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7C9C15A0–>00000000 [aclayers.dll] [3156]iexplore.exe–>shell32.dll–>SHExtractIconsW, Type: Inline - RelativeJump 0x7CA05712–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D–>00000000 [ieframe.dll] [3156]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072–>00000000 [ieframe.dll] [3156]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144–>00000000 [ieframe.dll] [3156]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB–>00000000 [ieframe.dll] [3156]iexplore.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [3156]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7E4112F4–>00000000 [aclayers.dll] [3156]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7E411208–>00000000 [aclayers.dll] [3156]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7E411340–>00000000 [aclayers.dll] [3156]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C–>00000000 [ieframe.dll] [3156]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7E450838–>00000000 [ieframe.dll] [3156]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082–>00000000 [ieframe.dll] [3156]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5–>00000000 [ieframe.dll] [3156]iexplore.exe–>wininet.dll–>InternetOpenA, Type: Inline - RelativeJump 0x3D953081–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>wininet.dll–>InternetOpenUrlA, Type: Inline - RelativeJump 0x3D956F5A–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>wininet.dll–>InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D951615–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x3D9513D4–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x3D931480–>00000000 [shimeng.dll] [3156]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x3D931484–>00000000 [aclayers.dll] [3156]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x3D931418–>00000000 [aclayers.dll] [3156]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x3D9313EC–>00000000 [aclayers.dll] [3156]iexplore.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll] [3156]iexplore.exe–>ws2_32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71AB10A8–>00000000 [aclayers.dll] [3156]iexplore.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [3156]iexplore.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [3156]iexplore.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [3704]iexplore.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [3704]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77DD1214–>00000000 [aclayers.dll] [3704]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77DD105C–>00000000 [aclayers.dll] [3704]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77DD11E0–>00000000 [aclayers.dll] [3704]iexplore.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [3704]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77F11084–>00000000 [aclayers.dll] [3704]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77F11078–>00000000 [aclayers.dll] [3704]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77F110B8–>00000000 [aclayers.dll] [3704]iexplore.exe–>kernel32.dll–>CreateActCtxW, Type: Inline - RelativeJump 0x7C8154FC–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>CreateFileW, Type: Inline - RelativeJump 0x7C810800–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [3704]iexplore.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [3704]iexplore.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0040111C–>00000000 [shimeng.dll] [3704]iexplore.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [3704]iexplore.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [3704]iexplore.exe–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x00401060–>00000000 [aclayers.dll] [3704]iexplore.exe–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x004010B8–>00000000 [aclayers.dll] [3704]iexplore.exe–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x00401078–>00000000 [aclayers.dll] [3704]iexplore.exe–>kernel32.dll–>ReplaceFile, Type: Inline - RelativeJump 0x7C836C6C–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [3704]iexplore.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [3704]iexplore.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>mswsock.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71A51178–>00000000 [shimeng.dll] [3704]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71A51184–>00000000 [aclayers.dll] [3704]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x71A511A0–>00000000 [aclayers.dll] [3704]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [3704]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [3704]iexplore.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [3704]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7C9C13E8–>00000000 [aclayers.dll] [3704]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExA, Type: IAT modification 0x7C9C163C–>00000000 [aclayers.dll] [3704]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7C9C161C–>00000000 [aclayers.dll] [3704]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7C9C15A0–>00000000 [aclayers.dll] [3704]iexplore.exe–>shell32.dll–>SHExtractIconsW, Type: Inline - RelativeJump 0x7CA05712–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D–>00000000 [ieframe.dll] [3704]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072–>00000000 [ieframe.dll] [3704]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144–>00000000 [ieframe.dll] [3704]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB–>00000000 [ieframe.dll] [3704]iexplore.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [3704]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7E4112F4–>00000000 [aclayers.dll] [3704]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7E411208–>00000000 [aclayers.dll] [3704]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7E411340–>00000000 [aclayers.dll] [3704]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C–>00000000 [ieframe.dll] [3704]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7E450838–>00000000 [ieframe.dll] [3704]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082–>00000000 [ieframe.dll] [3704]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5–>00000000 [ieframe.dll] [3704]iexplore.exe–>wininet.dll–>InternetOpenA, Type: Inline - RelativeJump 0x3D953081–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>wininet.dll–>InternetOpenUrlA, Type: Inline - RelativeJump 0x3D956F5A–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>wininet.dll–>InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D951615–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x3D9513D4–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x3D931480–>00000000 [shimeng.dll] [3704]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x3D931484–>00000000 [aclayers.dll] [3704]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x3D931418–>00000000 [aclayers.dll] [3704]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x3D9313EC–>00000000 [aclayers.dll] [3704]iexplore.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll] [3704]iexplore.exe–>ws2_32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71AB10A8–>00000000 [aclayers.dll] [3704]iexplore.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [3704]iexplore.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [3704]iexplore.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>CreateActCtxW, Type: Inline - RelativeJump 0x7C8154FC–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>CreateFileW, Type: Inline - RelativeJump 0x7C810800–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>ReplaceFile, Type: Inline - RelativeJump 0x7C836C6C–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>SetUnhandledExceptionFilter, Type: Inline - RelativeJump 0x7C84495D–>00000000 [MSO.DLL] [4008]OUTLOOK.EXE–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [4008]OUTLOOK.EXE–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [4008]OUTLOOK.EXE–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [4008]OUTLOOK.EXE–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>shell32.dll–>SHExtractIconsW, Type: Inline - RelativeJump 0x7CA05712–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>wininet.dll–>InternetOpenA, Type: Inline - RelativeJump 0x3D953081–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>wininet.dll–>InternetOpenUrlA, Type: Inline - RelativeJump 0x3D956F5A–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>wininet.dll–>InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D951615–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x3D9513D4–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [4008]OUTLOOK.EXE–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [4008]OUTLOOK.EXE–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [452]svchost.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [452]svchost.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [452]svchost.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [452]svchost.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [452]svchost.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [452]svchost.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [452]svchost.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [452]svchost.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [452]svchost.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [452]svchost.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [452]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [452]svchost.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [452]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [452]svchost.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page] [528]p4sshLink.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [528]p4sshLink.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77DD1214–>00000000 [aclayers.dll] [528]p4sshLink.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77DD105C–>00000000 [aclayers.dll] [528]p4sshLink.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77DD11E0–>00000000 [aclayers.dll] [528]p4sshLink.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [528]p4sshLink.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77F11084–>00000000 [aclayers.dll] [528]p4sshLink.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77F11078–>00000000 [aclayers.dll] [528]p4sshLink.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77F110B8–>00000000 [aclayers.dll] [528]p4sshLink.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0043C0A8–>00000000 [shimeng.dll] [528]p4sshLink.exe–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x0043C064–>00000000 [aclayers.dll] [528]p4sshLink.exe–>mswsock.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71A51178–>00000000 [shimeng.dll] [528]p4sshLink.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71A51184–>00000000 [aclayers.dll] [528]p4sshLink.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x71A511A0–>00000000 [aclayers.dll] [528]p4sshLink.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [528]p4sshLink.exe–>shell32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7C9C13E8–>00000000 [aclayers.dll] [528]p4sshLink.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExA, Type: IAT modification 0x7C9C163C–>00000000 [aclayers.dll] [528]p4sshLink.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7C9C161C–>00000000 [aclayers.dll] [528]p4sshLink.exe–>shell32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7C9C15A0–>00000000 [aclayers.dll] [528]p4sshLink.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [528]p4sshLink.exe–>user32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7E4112F4–>00000000 [aclayers.dll] [528]p4sshLink.exe–>user32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7E411208–>00000000 [aclayers.dll] [528]p4sshLink.exe–>user32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7E411340–>00000000 [aclayers.dll] [528]p4sshLink.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll] [528]p4sshLink.exe–>ws2_32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71AB10A8–>00000000 [aclayers.dll] [792]lsass.exe–>kernel32.dll–>CreateFileA, Type: Inline - RelativeJump 0x7C801A28–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>CreateProcessA, Type: Inline - RelativeJump 0x7C80236B–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>CreateProcessInternalA, Type: Inline - RelativeJump 0x7C81D54E–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>ExitProcess, Type: Inline - RelativeJump 0x7C81CB12–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>ExitThread, Type: Inline - RelativeJump 0x7C80C0F8–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FD [unknown_code_page] [792]lsass.exe–>kernel32.dll–>ExitThread, Type: Inline - SEH 0x7C80C0FE [unknown_code_page] [792]lsass.exe–>kernel32.dll–>FreeLibrary, Type: Inline - RelativeJump 0x7C80AC7E–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>GetProcAddress, Type: Inline - RelativeJump 0x7C80AE40–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>GetThreadContext, Type: Inline - RelativeJump 0x7C83973D–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - RelativeJump 0x7C80FDCD–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD2 [unknown_code_page] [792]lsass.exe–>kernel32.dll–>GlobalAlloc, Type: Inline - SEH 0x7C80FDD3 [unknown_code_page] [792]lsass.exe–>kernel32.dll–>LoadLibraryA, Type: Inline - RelativeJump 0x7C801D7B–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>LoadLibraryExA, Type: Inline - RelativeJump 0x7C801D53–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - RelativeJump 0x7C801AF5–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFA [unknown_code_page] [792]lsass.exe–>kernel32.dll–>LoadLibraryExW, Type: Inline - SEH 0x7C801AFB [unknown_code_page] [792]lsass.exe–>kernel32.dll–>LoadLibraryW, Type: Inline - RelativeJump 0x7C80AEEB–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>ResumeThread, Type: Inline - RelativeJump 0x7C832927–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>SetThreadContext, Type: Inline - RelativeJump 0x7C863C09–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>VirtualProtectEx, Type: Inline - RelativeJump 0x7C801A61–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>WinExec, Type: Inline - RelativeJump 0x7C86250D–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump 0x7C810E27–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page] [792]lsass.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page] [792]lsass.exe–>kernel32.dll–>WriteFileEx, Type: Inline - RelativeJump 0x7C85D6D9–>00000000 [sophos_detoured.dll] [792]lsass.exe–>kernel32.dll–>WriteProcessMemory, Type: Inline - RelativeJump 0x7C802213–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E481 [unknown_code_page] [792]lsass.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - SEH 0x7C90E482 [unknown_code_page] [792]lsass.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>accept, Type: Inline - RelativeJump 0x71AC1040–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>bind, Type: Inline - RelativeJump 0x71AB4480–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>closesocket, Type: Inline - RelativeJump 0x71AB3E2B–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>connect, Type: Inline - RelativeJump 0x71AB4A07–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>getpeername, Type: Inline - RelativeJump 0x71AC0B68–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>listen, Type: Inline - RelativeJump 0x71AB8CD3–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>recv, Type: Inline - RelativeJump 0x71AB676F–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>send, Type: Inline - RelativeJump 0x71AB4C27–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>WSASocketA, Type: Inline - RelativeJump 0x71AB8B6A–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>WSAStartup, Type: Inline - RelativeJump 0x71AB6A55–>00000000 [sophos_detoured.dll] [792]lsass.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5A [unknown_code_page] [792]lsass.exe–>ws2_32.dll–>WSAStartup, Type: Inline - SEH 0x71AB6A5B [unknown_code_page]

Hi gtbear,

How's your computer running now? Did you have to change your homepage again?

I need you to run the following scan: Eset Online Scanner

• Place a check mark in the box YES, I accept the Terms Of Use
• Click the Start button.
• Now click the Install button.
• Click Start.  The scanner engine will initialize and update.
• Do Not place a check mark in the box beside Remove found threats.
• Click the Scan button.  The scan will now run, please be patient.
• When the scan finishes click the Details tab.
• Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

Morning Noodle Tech, Computers running OK and the Home Page hijack seems to have cleared so Thank you for that. Here's the ESET file D:\_OTL\MovedFiles\03082011_085533\D_Documents and Settings\ucyzdun\Local Settings\Application Data\gersai.exe IRC/SdBot trojan D:\_OTL\MovedFiles\03082011_085533\D_Documents and Settings\ucyzdun\Start Menu\Programs\Startup\frilm.exe IRC/SdBot trojan D:\_OTL\MovedFiles\03082011_085533\D_Documents and Settings\ucyzdun\Start Menu\Programs\Startup\peyci.exe IRC/SdBot trojan Regards David

Hi gtbear,

Great! Your system appears to be clean.

Now time for some cleanup.

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

I noticed you are not running a firewall. Firewalls help protect you on the internet by making your PC invisible to hackers and stops malicious software from sending your data out on the Internet.

Try Zone Alarm Free Firewall

===================================================

Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.  

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Then go to Start > Run and type: Cleanmgr
• Click "OK".
• Click the "More Options" Tab.
• Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

• Click Start > Run
• Type Inetcpl.cpl and click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected and Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to Prompt, and ("Initialize and Script ActiveX controls not marked as safe") to Disable.
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis.  With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update   regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

THanks for all your time and effort.