[Closed] logging into laptop and running problems

kaklinsky Topic Starter

Post #1January 4, 2009, 10:29 PM UTC

Hi,

My HP tc4200 was running fine until tonight when i got the following error whilst trying to log in;-

Logonui.exe- Application Error.
The application failed to initialize properly (0000006). Click OK to terminate the applicaton.
I needed to click the OK 5 times and then was asked to enter my username and password.

At first the desktop image appeared on screen but no desktop icons or taskbar. I had to do a physical shutdown after an hour. I logged in once more and still got the above error message but this time icons did appear on screen. Most of my taskbar icons have disappeared along with sound and other buttons on PC not working. I have also lost wireless and internet capabilities.

The laptop is very very slow in opening and running anything but i did manage to geta HiKackThis log which i have posted below.

I would be grateful for any help and advice on this.

Best regards,
Kakalinsy

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:36:55, on 04/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\Program Files\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\HPQ\Q Menu\QICON.EXE
C:\Program Files\HPQ\Q Menu\CpqMcSrV.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\m jamshad\My Documents\AVG\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: (no name) - {ACED1C9F-2718-4512-9F69-F4E28C1F484F} - C:\WINDOWS\system32\ddcbxWpm.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\2.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\2.bin\SPYBLOCK.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Q Menu] C:\Program Files\HPQ\Q Menu\QICON.EXE -QICON
O4 - HKLM\..\Run: [hpqMcSrv] "C:\Program Files\HPQ\Q Menu\CpqMcSrV.exe" /Start
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZDLM.exe /hide
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1214616681654
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1214616670858
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: ddcbxWpm - ddcbxWpm.dll (file missing)
O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PC Angel (PCA) - Unknown owner - C:\WINDOWS\TEMP\UPDATE\SMINST\PCAngel.exe (file missing)
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

–
End of file - 12158 bytes

StartupList report, 04/01/2009, 21:49:05
StartupList version: 1.52.2
Started from : C:\Documents and Settings\m jamshad\My Documents\AVG\hijackthis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16762)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\Program Files\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\HPQ\Q Menu\QICON.EXE
C:\Program Files\HPQ\Q Menu\CpqMcSrV.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\m jamshad\My Documents\AVG\hijackthis.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\m jamshad\Start Menu\Programs\Startup]
OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Bluetooth.lnk = ?
DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

TabletWizard = C:\WINDOWS\help\SplshWrp.exe
TabletTip = "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
WatchDog = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
SoundMAXPnP = C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
SoundMAX = C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
PTHOSTTR = C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
Recguard = C:\WINDOWS\Sminst\Recguard.exe
Reminder = C:\WINDOWS\Creator\Remind_XP.exe
Scheduler = C:\WINDOWS\SMINST\Scheduler.exe
SynTPStart = C:\Program Files\Synaptics\SynTP\SynTPStart.exe
IntelZeroConfig = "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
IntelWireless = "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
hpWirelessAssistant = C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
CognizanceTS = rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
AGRSMMSG = AGRSMMSG.exe
igfxtray = C:\WINDOWS\system32\igfxtray.exe
igfxhkcmd = C:\WINDOWS\system32\hkcmd.exe
igfxpers = C:\WINDOWS\system32\igfxpers.exe
avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
GrooveMonitor = "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
QlbCtrl.exe = C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
Q Menu = C:\Program Files\HPQ\Q Menu\QICON.EXE -QICON
hpqMcSrv = "C:\Program Files\HPQ\Q Menu\CpqMcSrV.exe" /Start
ZoneAlarm Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
Zinio DLM = C:\Program Files\Zinio\ZDLM.exe /hide
Window Washer = C:\Program Files\Webroot\Washer\wwDisp.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
=

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

————————————————–

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

————————————————–

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

————————————————–

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

————————————————–

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=APSHook.dll

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\ssbezier.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

————————————————–

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

————————————————–

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1 %*)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

————————————————–

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll - {72853161-30C5-4D22-B7F9-0BBC1D38A37E}
(no name) - (no file) - {7E853D72-626A-48EC-A868-BA8D5E23E045}
(no name) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
(no name) - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - C:\WINDOWS\system32\ddcbxWpm.dll (file missing) - {ACED1C9F-2718-4512-9F69-F4E28C1F484F}
(no name) - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E}
HP Credential Manager for ProtectTools - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll - {DF21F1DB-80C6-11D3-9483-B03D0EC10000}
ZoneAlarm Spy Blocker BHO - C:\Program Files\ZoneAlarmSB\bar\2.bin\SPYBLOCK.DLL - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}

————————————————–

Enumerating Task Scheduler jobs:

*No jobs found*

————————————————–

Enumerating Download Program Files:

[ActiveScan 2.0 Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\as2stubie.dll
CODEBASE = http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu…b?1214616681654

[HpProductDetection Class]
InProcServer32 = C:\Program Files\HP\Common\HPDeviceDetection.dll
CODEBASE = http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu…b?1214616670858

————————————————–

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\mswsock.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\rsvpsp.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll

————————————————–

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Microsoft Embedded Controller Driver: system32\DRIVERS\ACPIEC.sys (system)
aeaudio: system32\drivers\aeaudio.sys (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AEGIS Protocol (IEEE 802.1x) v3.7.5.0: system32\DRIVERS\AegisP.sys (autostart)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Agere Systems Soft Modem: system32\DRIVERS\AGRSM.sys (manual start)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Logon Session Broker: %SystemRoot%\System32\svchost.exe -k Cognizance (autostart)
Local Communication Channel: %SystemRoot%\System32\svchost.exe -k Cognizance (autostart)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
aswFsBlk: system32\DRIVERS\aswFsBlk.sys (autostart)
avast! iAVS4 Control Service: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" (autostart)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
avast! Antivirus: "C:\Program Files\Alwil Software\Avast4\ashServ.exe" (autostart)
avast! Mail Scanner: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (manual start)
avast! Web Scanner: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (manual start)
Broadcom NetXtreme Gigabit Ethernet: system32\DRIVERS\b57xp32.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Bluetooth Service: C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (autostart)
WIDCOMM USB Bluetooth Driver: System32\Drivers\btwusb.sys (manual start)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
ClntMgmt.sys: \SystemRoot\System32\Drivers\ClntMgmt.sys (system)
.NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
Microsoft AC Adapter Driver: system32\DRIVERS\CmBatt.sys (manual start)
Microsoft Composite Battery Driver: system32\DRIVERS\compbatt.sys (system)
COM+ System Application: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Logical Disk Manager Driver: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
Intel® PROSet/Wireless Event Log: C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (autostart)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Windows Presentation Foundation Font Cache 3.0.0.0: C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
GTIPCI21: system32\DRIVERS\gtipci21.sys (manual start)
Google Updater Service: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" (manual start)
HBtnKey: system32\DRIVERS\cpqbttn.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Human Interface Device Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
HpqKbFilter Driver: system32\DRIVERS\HpqKbFiltr.sys (manual start)
HP WMI Interface: C:\Program Files\HPQ\SHARED\HPQWMI.exe (manual start)
hpqwmiex: C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (autostart)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
ialm: system32\DRIVERS\ialmnt5.sys (manual start)
InstallDriver Table Manager: "c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
Windows CardSpace: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\system32\imapi.exe (manual start)
IntelIde: system32\DRIVERS\intelide.sys (system)
Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IrDA Protocol: system32\DRIVERS\irda.sys (autostart)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
Infrared Monitor: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)
KLIF: system32\DRIVERS\klif.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Microsoft Office Groove Audit Service: "C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" (manual start)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Net.Tcp Port Sharing Service: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NMSAccessU: C:\Program Files\CDBurnerXP\NMSAccessU.exe (autostart)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
Microsoft Office Diagnostics Service: "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (manual start)
Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)
Parallel port driver: system32\DRIVERS\parport.sys (manual start)
PC Angel: C:\WINDOWS\TEMP\UPDATE\SMINST\PCAngel.exe (autostart)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
Pcmcia: system32\DRIVERS\pcmcia.sys (system)
PersonalSecureDrive: \SystemRoot\System32\drivers\psd.sys (system)
Personal Secure Drive Service: "C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE" (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (IrDA): system32\DRIVERS\rasirda.sys (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: system32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Intel® PROSet/Wireless Registry Service: C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (autostart)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
Link-Layer Topology Discovery Responder: system32\DRIVERS\rspndr.sys (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Intel® PROSet/Wireless Service: C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (autostart)
WLAN Transport: system32\DRIVERS\s24trans.sys (autostart)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
SASKUTIL: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (system)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
sdbus: system32\DRIVERS\sdbus.sys (manual start)
Secdrv: system32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serial Port Driver: system32\DRIVERS\serial.sys (manual start)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SMC IrCC Miniport Device Driver: system32\DRIVERS\smcirda.sys (manual start)
smwdm: system32\drivers\smwdm.sys (manual start)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
srescan: system32\ZoneLabs\srescan.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (manual start)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{99E2F33D-87C2-453E-9DB2-2495DB55BE5D} (manual start)
Synaptics TouchPad Driver: system32\DRIVERS\SynTP.sys (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
tifm21: system32\drivers\tifm21.sys (manual start)
Telnet: C:\WINDOWS\system32\tlntsvr.exe (disabled)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (manual start)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
USB2 Enabled Hub: system32\DRIVERS\usbhub.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start)
Messenger Sharing Folders USN Journal Reader service: "C:\Program Files\Windows Live\Messenger\usnsvc.exe" (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
vsdatant: System32\vsdatant.sys (system)
TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP: system32\DRIVERS\w29n51.sys (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wacom Penabled MiniDriver: system32\DRIVERS\wisdpen.sys (manual start)
Windows Live Setup Service: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe" (manual start)
Windows Media Connect Service: C:\Program Files\Windows Media Connect 2\wmccds.exe (manual start)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Windows Management Interface for ACPI: system32\DRIVERS\wmiacpi.sys (system)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\wmpnetwk.exe" (manual start)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Washer AutoComplete: C:\WINDOWS\system32\wwSecure.exe (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

————————————————–

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

————————————————–
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

————————————————–

End of report, 38,615 bytes
Report generated in 10.391 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

jpshortstuff

Post #2January 16, 2009, 12:23 PM UTC

Hi, and Welcome to WhatTheTech

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through the instructions before starting to follow them to make sure you understand everything you have to do.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Apologies in the delay in a response. We are overwhelmed with logs at the moment and there aren't enough helpers to go around. If you still require help, please do the following:

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.scr to run the tool.
When done, DDS.txt will open.
Click Yes at the next prompt for Optional Scan.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Please describe how your computer is behaving at the moment, listing any symptoms and problems that you are experiencing.

Thanks.

kaklinsky

Post #3January 16, 2009, 6:53 PM UTC

Hi, Thanks for the reply. I look forward to your help. My laptop was running fine but all of a sudden it takes around 5 minutes to go from the windows Xp loading site to asking me to log in. Once the desktop loads up i get the following messages:- zcfgSvc.exe-Application error. application failed to initialize properly (0Xc0000006). Click OK to terminate the application. ifrmewrk.exe-Application error. application failed to initialize properly (0Xc0000006). Click OK to terminate the application. I click Ok and then the computer is very slow, icons are missing from the taskbar, my antivirus program has been disactivated (even in safe mode it won't do a system scan). I am unable to connect to the internet (wireless or connected via cable) and cannot open any folders or programs off the desktop or from the start menu. The item highlights but then nothing happens. I can only open them in safemode. As requested the DDS.txt report and attach.txt file. DDS (Ver_09-01-07.01) - NTFSx86 MINIMAL Run by [removed] at 18:43:57.87 on 16/01/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.326 [GMT 0:00] AV: avast! antivirus 4.8.1290 [VPS 090104-0] *On-access scanning enabled* (Updated) FW: ZoneAlarm Firewall *enabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\SYSTEM32\WISPTIS.EXE C:\WINDOWS\System32\tabbtnu.exe C:\Program Files\HPQ\IAM\bin\asghost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\kaklinsky\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.tiscali.co.uk/ BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: HP Credential Manager for ProtectTools: {df21f1db-80c6-11d3-9483-b03d0ec10000} - c:\program files\hpq\iam\bin\ItIeAddIN.dll BHO: ZoneAlarm Spy Blocker BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\2.bin\SPYBLOCK.DLL TB: ZoneAlarm Spy Blocker: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\2.bin\SPYBLOCK.DLL TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [Window Washer] c:\program files\webroot\washer\wwDisp.exe mRun: [TabletWizard] c:\windows\help\SplshWrp.exe mRun: [TabletTip] "c:\program files\common files\microsoft shared\ink\tabtip.exe" /resume mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [WatchDog] c:\program files\intervideo\dvd check\DVDCheck.exe mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [PTHOSTTR] c:\program files\hewlett-packard\hp protecttools security manager\PTHOSTTR.EXE /Start mRun: [Recguard] c:\windows\sminst\Recguard.exe mRun: [Reminder] c:\windows\creator\Remind_XP.exe mRun: [Scheduler] c:\windows\sminst\Scheduler.exe mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe" mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe mRun: [CognizanceTS] rundll32.exe c:\progra~1\hpq\iam\bin\AsTsVcc.dll,RegisterModule mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [Q Menu] c:\program files\hpq\q menu\QICON.EXE -QICON mRun: [hpqMcSrv] "c:\program files\hpq\q menu\CpqMcSrV.exe" /Start mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\mjamsh~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dvdche~1.lnk - c:\program files\intervideo\dvd check\DVDCheck.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Send To &Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: IfxWlxEN - IfxWlxEN.dll Notify: igfxcui - igfxdev.dll Notify: loginkey - c:\program files\common files\microsoft shared\ink\loginkey.dll Notify: OneCard - c:\program files\hpq\iam\bin\AsWlnPkg.dll Notify: TabBtnWL - TabBtnWL.dll Notify: tpgwlnotify - tpgwlnot.dll AppInit_DLLs: APSHook.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\mjamsh~1\applic~1\mozilla\firefox\profiles\a4049wq3.default\ ============= SERVICES / DRIVERS =============== R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2005-11-29 36768] R3 wisdpen;Wacom Penabled MiniDriver;c:\windows\system32\drivers\wisdpen.sys [2007-1-22 34736] S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-7-1 110160] S1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2008-10-27 127768] S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys –> c:\program files\superantispyware\SASKUTIL.sys [?] S1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2008-7-1 394952] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-7-1 254040] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-7-1 352920] S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2008-6-28 88192] S4 ASBroker;Logon Session Broker;c:\windows\system32\svchost.exe -k Cognizance [2004-8-3 14336] S4 ASChannel;Local Communication Channel;c:\windows\system32\svchost.exe -k Cognizance [2004-8-3 14336] S4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-7-1 20560] S4 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-7-1 155160] S4 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?] =============== Created Last 30 ================ 2009-01-07 16:55 161,792 a——- c:\windows\SWREG.exe 2009-01-07 16:55 98,816 a——- c:\windows\sed.exe 2009-01-06 22:31 277 a——- c:\windows\boc427.ini 2009-01-06 21:00 578,560 ac—— c:\windows\system32\dllcache\user32.dll 2009-01-06 20:45 –d—– c:\windows\ERUNT 2008-12-21 19:47 –d—– c:\docume~1\mjamsh~1\applic~1\Canneverbe_Limited 2008-12-21 19:43 –d—– c:\windows\system32\XPSViewer 2008-12-21 19:40 1,676,288 -c—— c:\windows\system32\dllcache\xpssvcs.dll 2008-12-21 19:40 597,504 -c—— c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2008-12-21 19:40 575,488 -c—— c:\windows\system32\dllcache\xpsshhdr.dll 2008-12-21 19:40 89,088 -c—— c:\windows\system32\dllcache\filterpipelineprintproc.dll 2008-12-21 19:40 1,676,288 ——– c:\windows\system32\xpssvcs.dll 2008-12-21 19:40 575,488 ——– c:\windows\system32\xpsshhdr.dll 2008-12-21 19:40 117,760 ——– c:\windows\system32\prntvpt.dll 2008-12-21 19:40 –d—– C:\835c1fb91f52c64bc0b8481e 2008-12-21 18:38 –d—– c:\docume~1\mjamsh~1\applic~1\.BitTornado 2008-12-17 21:42 545,280 a——- c:\windows\flashax.exe 2008-12-17 21:42 12,288 a——- c:\windows\impborl.dll 2008-12-17 21:42 –d—– c:\windows\Ip Man dir ==================== Find3M ==================== 2009-01-07 18:34 2,392,096 a–sh— c:\windows\system32\drivers\fidbox.dat 2009-01-06 18:19 28,820 a–sh— c:\windows\system32\drivers\fidbox.idx 2008-10-27 17:52 4,212 —-h— c:\windows\system32\zllictbl.dat 2008-10-23 12:36 286,720 a——- c:\windows\system32\gdi32.dll ============= FINISH: 18:45:01.28 ===============

Attachments:

📎Attach.txt

jpshortstuff

Post #4January 17, 2009, 9:20 AM UTC

Hi

I'm afraid this doesn't look to be a Malware related problem. I can see that you have issues some services/drivers that aren't managing to load on startup. Since I am here to deal with you Malware issues, I may have to refer you to our Techies who have a much greater knowledge of troubleshooting these non-Malware problems than I do.

Have you considered/tried performing a System Restore to before these problems started happening?

Let's have one last check for any Malware interference, just in case.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Thanks.

kaklinsky

Post #5January 17, 2009, 6:40 PM UTC

Hi,
I have done a system restore to a point at which the laptop was working fine and this has not resolved the issues. I haved run GMER and the log is below. If youthink that this is not a malware issue then i would appreciate you advise as how best to proceed. Is it worth trying a repair install of XP using a XP disc with SP3 and if so would this get rid of the tablet features already on the laptop? Ultimately i might have format and reinstall. I look forward to hearing from you.

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-17 18:13:26
Windows 5.1.2600 Service Pack 3

—- User code sections - GMER 1.0.14 —-

.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + FFE25751 7C9C217D 272 Bytes [ C0, F1, 77, CB, A8, F1, 77, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + FFE25862 7C9C228E 1 Byte [ 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + FFE25864 7C9C2290 89 Bytes [ FF, 30, 83, 7C, 17, F8, 82, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + FFE258BE 7C9C22EA 121 Bytes [ 91, 7C, F9, BC, 80, 7C, 0D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + FFE25938 7C9C2364 3 Bytes [ 18, AD, 80 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceExW + 8C 7C9EA5DD 267 Bytes [ 53, 48, 47, 65, 74, 44, 65, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceExW + 198 7C9EA6E9 25 Bytes [ 72, 6C, 61, 79, 49, 6E, 64, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceExW + 1B2 7C9EA703 40 Bytes [ 53, 48, 47, 65, 74, 49, 6E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceExW + 1DB 7C9EA72C 181 Bytes [ 77, 4C, 69, 6E, 6B, 49, 6E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceExW + 291 7C9EA7E2 818 Bytes [ 53, 48, 47, 65, 74, 53, 68, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFree + 29 7C9EAB15 151 Bytes [ 6E, 72, 65, 61, 64, 4D, 61, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFree + C1 7C9EABAD 231 Bytes [ 65, 49, 6D, 61, 67, 65, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLoadOLE + 54 7C9EAC95 140 Bytes [ 53, 68, 65, 52, 65, 6D, 6F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLoadOLE + E1 7C9EAD22 122 Bytes [ 53, 68, 65, 6C, 6C, 45, 78, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILGetSize + D 7C9EAD9D 34 Bytes [ 53, 68, 65, 6C, 6C, 5F, 47, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILGetSize + 30 7C9EADC0 334 Bytes [ 49, 6D, 61, 67, 65, 4C, 69, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILClone + 11A 7C9EAF0F 103 Bytes [ 53, 74, 72, 53, 74, 72, 49, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILClone + 182 7C9EAF77 224 Bytes [ 68, 61, 72, 65, 64, 00, 73, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILClone + 263 7C9EB058 95 Bytes [ 00, 50, FF, 15, 60, 15, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCloneFirst + 54 7C9EB0B8 36 Bytes [ 00, 00, 8B, F8, 39, 1D, C4, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCloneFirst + 7A 7C9EB0DE 3 Bytes [ 90, 90, 90 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCloneFirst + 7E 7C9EB0E2 96 Bytes [ FF, 55, 8B, EC, 83, EC, 14, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCombine + 2E 7C9EB143 7 Bytes [ 74, 1D, 8B, 07, 8B, CF, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCombine + 36 7C9EB14B 26 Bytes [ CC, 00, 00, 00, 85, C0, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCombine + 51 7C9EB166 86 Bytes CALL 7C9E83EC C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCombine + A8 7C9EB1BD 17 Bytes CALL 7C9E83EC C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCombine + BA 7C9EB1CF 37 Bytes [ 81, C1, 40, 02, 00, 00, 51, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDesktopFolder + 13 7C9EB77B 44 Bytes [ 3B, D7, 72, 1A, 77, 04, 3B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDesktopFolder + 40 7C9EB7A8 25 Bytes [ 5E, 5B, C9, C2, 10, 00, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDesktopFolder + 5A 7C9EB7C2 24 Bytes [ 15, 60, 15, 9C, 7C, 8B, F8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDesktopFolder + 73 7C9EB7DB 44 Bytes [ C7, 5F, 5E, 5D, C2, 04, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDesktopFolder + A0 7C9EB808 233 Bytes [ 90, 90, 90, 90, 90, C7, 01, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHRestricted + 38 7C9EC091 38 Bytes [ 85, C0, 74, 1E, 56, 8B, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHRestricted + 5F 7C9EC0B8 2 Bytes [ 90, 90 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHRestricted + 63 7C9EC0BC 10 Bytes [ 90, 8B, FF, 55, 8B, EC, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHRestricted + 6F 7C9EC0C8 41 Bytes [ 83, C0, 04, 50, FF, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHRestricted + 99 7C9EC0F2 35 Bytes [ 4D, 08, 56, 8B, F1, 57, C1, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILRemoveLastID + 1 7C9EC1B8 4 Bytes [ EC, 83, EC, 10 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILRemoveLastID + 8 7C9EC1BF 28 Bytes [ 85, C9, 0F, 85, 06, 07, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILRemoveLastID + 25 7C9EC1DC 93 Bytes [ 8B, C1, 8D, 50, 04, C7, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILRemoveLastID + 83 7C9EC23A 104 Bytes [ F8, 7F, 05, 0E, 00, 07, 80, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILRemoveLastID + EC 7C9EC2A3 6 Bytes [ 80, 0F, 8D, C6, 74, 00 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetSettings + 63 7C9EC413 75 Bytes [ 50, A5, 89, 45, C8, FF, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetSettings + AF 7C9EC45F 42 Bytes [ 74, 17, FF, 75, CC, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetSettings + DA 7C9EC48A 27 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetSettings + F6 7C9EC4A6 78 Bytes [ 0F, 8C, E4, 01, 00, 00, 56, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetSettings + 145 7C9EC4F5 5 Bytes [ 56, 57, 68, D0, 00 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCLSIDFromString + 26 7C9EC7D9 28 Bytes [ 55, 8B, EC, 8B, 45, 08, 53, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCLSIDFromString + 43 7C9EC7F6 96 Bytes CALL CA29C801
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCLSIDFromString + A4 7C9EC857 39 Bytes [ 47, 85, C0, 74, 49, 8B, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCLSIDFromString + CC 7C9EC87F 71 Bytes [ 11, 85, C0, 7C, 18, 56, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCLSIDFromString + 114 7C9EC8C7 5 Bytes [ FF, FF, 5D, C2, 10 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindLastID + 2A 7C9EC9A6 80 Bytes [ 53, FF, 75, 10, 8D, 4F, F0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindLastID + 7B 7C9EC9F7 53 Bytes [ CE, 2B, C8, D1, F9, 51, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindLastID + B1 7C9ECA2D 94 Bytes [ 75, 10, 53, FF, 37, FF, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindLastID + 110 7C9ECA8C 19 Bytes [ 73, 00, 00, 00, 41, 00, 6C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindLastID + 124 7C9ECAA0 55 Bytes [ 49, 00, 44, 00, 50, 00, 52, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHParseDisplayName + 3E 7C9EDBAE 133 Bytes [ 0F, 84, 78, 1A, 01, 00, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHParseDisplayName + C4 7C9EDC34 57 Bytes [ EC, 51, 51, 53, 56, 57, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHParseDisplayName + FF 7C9EDC6F 51 Bytes CALL 7C9EDB13 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHParseDisplayName + 133 7C9EDCA3 11 Bytes [ 55, 8B, EC, 83, EC, 18, A1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHParseDisplayName + 13F 7C9EDCAF 29 Bytes [ 56, 8B, F1, 89, 45, FC, 8B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHILCreateFromPath + 8C 7C9EE1CC 27 Bytes CALL 7C9EE171 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHILCreateFromPath + A8 7C9EE1E8 46 Bytes [ 00, 00, 8B, D8, 8B, 4D, FC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHILCreateFromPath + D8 7C9EE218 33 Bytes [ 8B, 45, 14, 53, 8B, 5D, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHILCreateFromPath + FA 7C9EE23A 89 Bytes [ 8D, BD, E4, FB, FF, FF, F3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHILCreateFromPath + 154 7C9EE294 19 Bytes [ 53, FF, 75, 14, 57, 50, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPath + 1 7C9EE2E0 8 Bytes [ EC, FF, 75, 10, FF, 75, 0C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPath + A 7C9EE2E9 13 Bytes [ 68, 90, 44, 9C, 7C, 6A, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPath + 18 7C9EE2F7 7 Bytes [ FF, 5D, C2, 0C, 00, 90, 90 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPath + 22 7C9EE301 6 Bytes [ 8B, FF, 55, 8B, EC, 81 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPath + 29 7C9EE308 52 Bytes [ 30, 02, 00, 00, A1, 48, F5, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathW + 1 7C9EED77 38 Bytes [ D8, 85, DB, 7C, 6B, 83, C6, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathW + 28 7C9EED9E 150 Bytes [ 51, 14, 8B, D8, 85, DB, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathW + BF 7C9EEE35 27 Bytes [ 8B, 75, 08, 89, 45, F8, 89, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathW + DC 7C9EEE52 13 Bytes [ 85, C0, 0F, 84, 92, 0B, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathW + EA 7C9EEE60 4 Bytes [ 85, 86, 1B, 00 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderLocation + 19 7C9EF27A 16 Bytes [ 8D, 43, 03, 50, FF, 15, 24, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderLocation + 2A 7C9EF28B 33 Bytes [ FF, 85, C0, 0F, 85, 26, 17, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderLocation + 4C 7C9EF2AD 49 Bytes [ 00, 00, 85, C0, 0F, 8D, 68, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderLocation + 7E 7C9EF2DF 16 Bytes [ 8B, FF, 55, 8B, EC, 51, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderLocation + E 7C9EF2F1 73 Bytes CALL 7C9EF13F C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderLocation + 58 7C9EF33B 1 Byte [ FB ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderLocation + 5B 7C9EF33E 3 Bytes [ 84, DC, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderLocation + 60 7C9EF343 3 Bytes [ 66, 83, 22 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderLocation + 64 7C9EF347 14 Bytes [ 5F, 5E, 5B, 5D, C2, 10, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCoCreateInstance 7C9EF5E2 65 Bytes [ 90, 8B, FF, 55, 8B, EC, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCoCreateInstance + 42 7C9EF624 40 Bytes [ 15, A8, F2, BB, 7C, 3B, C7, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCoCreateInstance + 6B 7C9EF64D 32 Bytes [ 08, 50, FF, 51, 18, 8B, 06, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCoCreateInstance + 8C 7C9EF66E 1 Byte [ 08 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCoCreateInstance + 8E 7C9EF670 27 Bytes [ 33, DB, EB, 93, 90, 90, 90, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderPathW + 1A 7C9EF792 5 Bytes [ 45, 39, B5, A4, FD ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderPathW + 20 7C9EF798 33 Bytes [ FF, 74, 52, C7, 85, AC, FD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderPathW + 42 7C9EF7BA 22 Bytes CALL 7C9EE7B4 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderPathW + 59 7C9EF7D1 58 Bytes [ FF, 8B, F8, 3B, FE, 7D, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSpecialFolderPathW + 94 7C9EF80C 41 Bytes [ FF, 50, F3, A5, FF, 15, 3C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsNetDrive + 2 7C9F063E 8 Bytes [ 15, 60, F5, 9E, 7C, 5D, C2, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsNetDrive + B 7C9F0647 98 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsNetDrive + 71 7C9F06AD 113 Bytes [ 8B, FF, 55, 8B, EC, 83, 3D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsNetDrive + E3 7C9F071F 7 Bytes CALL 7C9F01D6 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsNetDrive + EB 7C9F0727 18 Bytes [ DB, 75, 21, F6, 45, 15, 40, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealDriveType + 15 7C9F0EAB 80 Bytes [ 18, 3B, C3, 74, 02, 89, 30, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DriveType + 2E 7C9F0EFC 29 Bytes [ 8B, 45, 0C, 5D, C2, 08, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DriveType + 4C 7C9F0F1A 27 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DriveType + 68 7C9F0F36 28 Bytes [ 75, 0C, FF, 75, 08, FF, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DriveType + 85 7C9F0F53 50 Bytes CALL 7C9F0D0E C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DriveType + B8 7C9F0F86 21 Bytes [ 75, 0C, 53, FF, 15, 30, 1C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDListW + 3B 7C9F105F 17 Bytes JMP 7C9EB1B7 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDListW + 4D 7C9F1071 18 Bytes [ 56, 8B, 75, 08, 57, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDListW + 60 7C9F1084 25 Bytes [ 75, 14, 8B, D8, 8B, CF, 89, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDListW + 7A 7C9F109E 47 Bytes [ 00, 49, 0F, 85, 55, 4F, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDListW + AA 7C9F10CE 10 Bytes [ 85, DB, 8B, C3, 0F, 85, 13, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsEqual + 20 7C9F122F 7 Bytes [ C3, 5B, 5D, C2, 10, 00, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsEqual + 28 7C9F1237 26 Bytes [ 14, 8B, 76, 18, FF, 75, 10, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsEqual + 43 7C9F1252 2 Bytes [ FF, 55 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsEqual + 46 7C9F1255 48 Bytes [ EC, 81, EC, 54, 04, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsEqual + 77 7C9F1286 85 Bytes [ FF, 8D, 8D, D4, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowW + 27 7C9F12DC 23 Bytes [ 3B, F3, 0F, 9F, C0, 8B, 4D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowW + 41 7C9F12F6 5 Bytes [ 90, 90, 8B, FF, 55 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowW + 47 7C9F12FC 144 Bytes [ EC, 51, 51, 53, 56, 57, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowW + D8 7C9F138D 73 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowW + 122 7C9F13D7 7 Bytes [ C0, 75, AD, B8, FF, FF, 00 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsParent + 14 7C9F1440 77 Bytes [ 00, B9, FF, FF, 00, 00, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsParent + 62 7C9F148E 79 Bytes [ FF, 50, FF, B5, 98, FE, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILIsParent + B2 7C9F14DE 90 Bytes [ FF, 8D, 48, F0, FF, B5, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindChild + 4D 7C9F1539 95 Bytes CALL 7CA23B92 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindChild + AD 7C9F1599 37 Bytes [ DB, 7C, 41, 8B, 45, 0C, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindChild + D3 7C9F15BF 42 Bytes [ 45, 14, 8B, 4D, 0C, 8B, 11, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindChild + FE 7C9F15EA 133 Bytes [ 1B, C0, 83, D8, FF, E9, C5, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILFindChild + 184 7C9F1670 13 Bytes [ EC, FD, FF, FF, 50, 8D, 45, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetClassObject + A6 7C9F295F 85 Bytes [ A1, AC, FA, BC, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetClassObject + FC 7C9F29B5 5 Bytes [ 90, 90, 90, 90, 90 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetClassObject + 102 7C9F29BB 15 Bytes [ FF, 55, 8B, EC, 53, 56, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetClassObject + 112 7C9F29CB 9 Bytes [ 85, FF, BB, 02, 40, 00, 80, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetClassObject + 11C 7C9F29D5 62 Bytes [ 07, 8D, 4D, 0C, 51, 68, 38, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetImageLists + 26 7C9F3D2F 51 Bytes [ 89, 5D, F8, 33, C0, 8B, 7D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetImageLists + 5A 7C9F3D63 4 Bytes [ FF, 75, 20, 8B ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetImageLists + 5F 7C9F3D68 42 Bytes [ 08, FF, 75, 18, 83, C1, F0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetImageLists + 8A 7C9F3D93 63 Bytes [ 42, EB, 05, 00, FF, 75, 20, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetImageLists + CB 7C9F3DD4 15 Bytes [ FE, 34, 9F, 7C, AA, DF, 9F, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBindToParent + 72 7C9F3F02 32 Bytes [ F1, FF, 75, 08, FF, 76, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBindToParent + 93 7C9F3F23 9 Bytes [ 55, 8B, EC, 83, 3D, 78, FA, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBindToParent + 9D 7C9F3F2D 35 Bytes [ 0F, 84, 1F, E3, 00, 00, A1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBindToParent + C1 7C9F3F51 4 Bytes [ 90, 90, 90, 90 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBindToParent + C6 7C9F3F56 32 Bytes [ 8B, FF, 55, 8B, EC, 56, 8B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetCachedImageIndex + 1A 7C9F3FFA 45 Bytes CALL 7C9F4016 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetCachedImageIndex + 48 7C9F4028 348 Bytes [ 75, 08, 8B, F9, 8D, 5F, 20, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetCachedImageIndex + 1A5 7C9F4185 2 Bytes [ 00, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetCachedImageIndex + 1AA 7C9F418A 14 Bytes [ 00, 00, 3C, 7E, 87, 3B, DE, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_GetCachedImageIndex + 1B9 7C9F4199 14 Bytes [ 52, 1C, 6A, 90, 90, 90, 90, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyDeregister + 2D 7C9F5457 30 Bytes [ 00, 83, F8, 34, 0F, 86, F3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyDeregister + 4C 7C9F5476 64 Bytes [ 4E, 0F, 85, 9B, 3D, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyDeregister + 8D 7C9F54B7 10 Bytes [ 89, 7D, E0, 89, 7D, E4, 81, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyDeregister + 9A 7C9F54C4 35 Bytes [ 0F, 84, C8, 5D, 00, 00, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyDeregister + BE 7C9F54E8 50 Bytes [ 75, 10, FF, 75, 0C, FF, 75, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 2 7C9F659A 39 Bytes [ 75, 10, FF, 75, 08, E8, C4, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 2B 7C9F65C3 3 Bytes [ 8B, FF, 55 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 2F 7C9F65C7 26 Bytes [ EC, 51, 51, 56, 57, 8B, F1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 4A 7C9F65E2 55 Bytes [ 00, 8B, D8, 3B, DF, 74, 6F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 82 7C9F661A 93 Bytes [ C6, 0C, 89, 75, F8, 89, 7D, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyRegister + 1E 7C9F88F5 92 Bytes [ 8B, 4D, FC, 8B, C7, 5F, 5E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyRegister + 7D 7C9F8954 30 Bytes [ 14, 8B, 06, FF, 75, 10, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyRegister + 9C 7C9F8973 9 Bytes [ FF, 39, 46, 1C, 0F, 8C, B7, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyRegister + A6 7C9F897D 55 Bytes [ EB, A3, 90, 90, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifyRegister + DE 7C9F89B5 10 Bytes [ FF, 55, 8B, EC, 83, EC, 14, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_MergeMenus + 15 7C9F8FE9 37 Bytes CALL 7C9E83EC C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_MergeMenus + 3B 7C9F900F 14 Bytes [ 46, 24, 3B, C1, 8D, 50, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_MergeMenus + 4A 7C9F901E 66 Bytes [ 00, 5E, 5D, C2, 04, 00, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_MergeMenus + 8D 7C9F9061 2 Bytes [ 96, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_MergeMenus + 91 7C9F9065 15 Bytes [ EB, E1, FF, 75, 08, E8, B2, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderView + 2 7C9FA63C 88 Bytes [ 75, 08, 8D, 8E, 40, 02, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderView + 5B 7C9FA695 62 Bytes [ 00, 00, 85, C0, 0F, 84, 02, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderView + 9A 7C9FA6D4 130 Bytes [ 00, FF, 75, 08, 8B, 00, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderView + 11D 7C9FA757 5 Bytes [ 80, A6, 12, 02, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderView + 123 7C9FA75D 129 Bytes [ FE, F6, 86, 14, 02, 00, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapIDListToImageListIndexAsync + 38 7C9FCB7C 27 Bytes [ 8D, 88, 00, 8E, FF, FF, 81, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapIDListToImageListIndexAsync + 54 7C9FCB98 6 Bytes [ 00, 6A, 0A, EB, 3F, 6A ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapIDListToImageListIndexAsync + 5B 7C9FCB9F 83 Bytes [ 8D, 8D, F0, FE, FF, FF, 51, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapIDListToImageListIndexAsync + AF 7C9FCBF3 7 Bytes [ FF, 51, 57, FF, B5, F8, FE ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMapIDListToImageListIndexAsync + B7 7C9FCBFB 61 Bytes [ FF, 6A, 2B, 83, A5, F0, FE, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconExW + 4D 7C9FE204 78 Bytes [ CF, FF, 75, 08, 56, E8, B8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconExW + 9C 7C9FE253 31 Bytes [ 00, 68, 68, D2, 9F, 7C, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconExW + BC 7C9FE273 5 Bytes [ 00, 81, 32, 9F, 7C ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconExW + C2 7C9FE279 34 Bytes [ 00, 00, 00, 7A, DF, 66, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconExW + E9 7C9FE2A0 35 Bytes CALL 7C9E8417 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCloneSpecialIDList + 3A 7C9FE585 34 Bytes [ 89, 45, DC, 8B, 45, 14, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCloneSpecialIDList + 5D 7C9FE5A8 2 Bytes [ D9, A5 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCloneSpecialIDList + 60 7C9FE5AB 37 Bytes [ 15, 94, 1A, 9C, 7C, 8B, F8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCloneSpecialIDList + 86 7C9FE5D1 20 Bytes [ 03, 00, 00, 8B, 45, E8, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCloneSpecialIDList + 9B 7C9FE5E6 25 Bytes [ 56, 0C, 8B, F8, 33, F6, 3B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconW + 48 7C9FECE1 26 Bytes [ 7D, 10, 33, DB, 33, C0, 39, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconW + 63 7C9FECFC 57 Bytes [ 20, 85, C0, 74, 0C, FF, 46, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconW + 9D 7C9FED36 73 Bytes [ 75, 08, 8B, 46, 08, FF, 76, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHExtractIconsW + 36 7C9FED80 27 Bytes [ 59, 8B, C6, 5E, 5D, C2, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHExtractIconsW + 52 7C9FED9C 24 Bytes [ 08, 50, FF, 51, 08, C7, 06, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHExtractIconsW + 6B 7C9FEDB5 54 Bytes [ 75, 0C, 57, 8B, 7D, 08, 23, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHExtractIconsW + A2 7C9FEDEC 23 Bytes [ 33, C0, EB, E3, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHExtractIconsW + BA 7C9FEE04 159 Bytes [ 89, 46, 0C, 8B, 45, 08, C7, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetVersion + 5 7C9FFA08 74 Bytes [ 81, EC, 28, 02, 00, 00, A1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetVersion + 51 7C9FFA54 51 Bytes [ 00, 57, 68, 70, F5, BC, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetVersion + 85 7C9FFA88 6 Bytes [ 00, 00, 75, 15, 56, 53 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetVersion + 8C 7C9FFA8F 88 Bytes [ B5, EC, FD, FF, FF, E8, 65, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllGetVersion + E5 7C9FFAE8 14 Bytes [ 85, E4, FD, FF, FF, 89, B5, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetImageList + C 7C9FFF35 39 Bytes [ F0, FF, FF, 75, 03, 09, 46, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetImageList + 34 7C9FFF5D 13 Bytes JMP 7C9F3AFF C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetImageList + 43 7C9FFF6C 26 Bytes [ 88, F1, 9F, 7C, 6C, F1, 9F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetImageList + 5F 7C9FFF88 15 Bytes [ DC, F0, 9F, 7C, B8, F0, 9F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetImageList + 6F 7C9FFF98 11 Bytes [ 54, F0, 9F, 7C, 30, F0, 9F, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathResolve + 5B 7CA02AF5 338 Bytes [ B9, F1, 7E, AD, 7C, 89, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathResolve + 1AE 7CA02C48 2 Bytes [ E1, 69 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathResolve + 1B2 7CA02C4C 17 Bytes [ 34, 4B, 17, 9B, FF, 40, D2, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathResolve + 1C4 7CA02C5E 20 Bytes [ 00, 00, 80, 54, 27, F2, 82, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathResolve + 1DA 7CA02C74 19 Bytes [ 83, 25, A0, 00, BD, 7C, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteExW + 96 7CA02F99 61 Bytes [ 83, FF, 08, 0F, 8E, 51, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteExW + D4 7CA02FD7 33 Bytes [ 8B, 75, 08, 3B, F3, 75, 0C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteExW + F6 7CA02FF9 92 Bytes [ 10, 89, 91, AC, 00, BD, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteExW + 153 7CA03056 62 Bytes [ 00, 56, FF, 35, 84, 05, BD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteExW + 192 7CA03095 30 Bytes [ 1D, 9C, 7C, 99, 2B, C2, D1, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHTestTokenMembership + 54 7CA055B3 32 Bytes [ 00, 57, FF, B6, 04, 60, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHTestTokenMembership + 75 7CA055D4 179 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHTestTokenMembership + 129 7CA05688 5 Bytes [ FF, 55, 8B, EC, 56 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHTestTokenMembership + 12F 7CA0568E 19 Bytes CALL 7CA056F6 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHTestTokenMembership + 144 7CA056A3 50 Bytes [ 0F, 85, 97, 8E, 04, 00, 83, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenRegStream + 1 7CA05ABF 25 Bytes [ EC, 81, EC, 60, 02, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenRegStream + 1B 7CA05AD9 24 Bytes [ 89, BD, A8, FD, FF, FF, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenRegStream + 34 7CA05AF2 12 Bytes [ 8D, 70, 04, 56, FF, 15, F4, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenRegStream + 41 7CA05AFF 52 Bytes [ 75, 8D, 85, A0, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenRegStream + 76 7CA05B34 32 Bytes CALL 7CA05B8C C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILLoadFromStream + 4 7CA0693A 58 Bytes [ D8, 85, DB, 0F, 8C, 57, C1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILLoadFromStream + 3F 7CA06975 3 Bytes [ C3, 5B, E8 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILLoadFromStream + 43 7CA06979 27 Bytes [ 1A, FE, FF, C9, C2, 10, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILLoadFromStream + 5F 7CA06995 25 Bytes [ 5D, C2, 04, 00, 48, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILLoadFromStream + 79 7CA069AF 224 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_ShowDragImage + 1 7CA08C9D 114 Bytes [ 47, 30, 85, C0, 0F, 85, 7A, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_ShowDragImage + 74 7CA08D10 2 Bytes [ 50, 53 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_ShowDragImage + 77 7CA08D13 3 Bytes [ CE, F9, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_ShowDragImage + 7B 7CA08D17 43 Bytes [ 8B, 06, F7, D8, 1B, C0, 25, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_ShowDragImage + A7 7CA08D43 190 Bytes [ FF, 15, EC, 14, 9C, 7C, 85, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathAndSubDirW + F 7CA0B1D7 5 Bytes [ FF, 01, 00, 00, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathAndSubDirW + 15 7CA0B1DD 131 Bytes [ B5, F8, FD, FF, FF, FF, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExW + 17 7CA0B261 99 Bytes [ 16, 9C, 7C, 5F, 5E, 5B, C3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExW + 7B 7CA0B2C5 23 Bytes [ 85, C0, 7C, 23, 8B, 46, 10, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExW + 93 7CA0B2DD 84 Bytes [ 46, 30, 68, 55, 04, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExW + E8 7CA0B332 4 Bytes [ 84, 1E, E8, 04 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExW + ED 7CA0B337 3 Bytes [ 6A, 43, FF ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateRecycleBinIcon + 5 7CA0BCE5 39 Bytes [ 8B, C6, 5E, 5D, C2, 04, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateRecycleBinIcon + 2D 7CA0BD0D 49 Bytes [ BD, 7C, 3B, 18, 75, E0, 33, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateRecycleBinIcon + 5F 7CA0BD3F 93 Bytes JMP 7C9F9149 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateRecycleBinIcon + BD 7CA0BD9D 49 Bytes [ FF, 8B, F0, 3B, F7, 0F, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateRecycleBinIcon + EF 7CA0BDCF 69 Bytes [ FF, 75, FC, FF, 56, 18, E9, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsUserAnAdmin + 35 7CA0DB90 16 Bytes [ 07, 77, 03, 8B, 45, 08, 5D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsUserAnAdmin + 46 7CA0DBA1 19 Bytes [ 55, 8B, EC, 83, 7D, 0C, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsUserAnAdmin + 5A 7CA0DBB5 5 Bytes [ 0F, 85, EA, C1, 03 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsUserAnAdmin + 60 7CA0DBBB 42 Bytes [ 53, 8B, 5D, 14, 56, 8B, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsUserAnAdmin + 8B 7CA0DBE6 16 Bytes [ C5, C1, 03, 00, 8B, 45, 10, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathProcessCommand + 41 7CA0E4CC 1 Byte [ 53 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathProcessCommand + 43 7CA0E4CE 38 Bytes [ B5, D0, FB, FF, FF, 8D, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathProcessCommand + 6A 7CA0E4F5 9 Bytes [ FF, 83, FE, FF, 0F, 84, AE, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathProcessCommand + 74 7CA0E4FF 22 Bytes [ FF, 85, D0, FB, FF, FF, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathProcessCommand + 8B 7CA0E516 5 Bytes [ 89, 9D, B0, FB, FF ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFileAorW + 3D 7CA1192E 48 Bytes [ C1, FD, FF, FF, 08, 0F, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFileAorW + 6E 7CA1195F 41 Bytes [ 76, 28, 33, DB, 8D, 85, B8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFileAorW + 98 7CA11989 30 Bytes [ 40, 89, 85, F8, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFileAorW + B7 7CA119A8 50 Bytes [ FF, FF, 8D, 4E, FC, E8, 46, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFileAorW + EB 7CA119DC 51 Bytes [ FF, 8B, 85, 58, FF, FF, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListA + 15 7CA1B936 5 Bytes [ 33, C8, 89, 8B, A4 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListA + 1C 7CA1B93D 46 Bytes JMP 7CA1BDD3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListA + 4B 7CA1B96C 39 Bytes [ 85, C0, 0F, 85, 60, 04, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListA + 73 7CA1B994 5 Bytes [ 89, 83, A4, 00, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListA + 79 7CA1B99A 58 Bytes JMP 7CA1BDD4 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetFolderCustomSettingsW + 53 7CA1DC20 68 Bytes [ 76, 08, FF, D7, 85, C0, 74, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetFolderCustomSettingsW + 98 7CA1DC65 25 Bytes [ 00, FF, 45, E4, 8B, 45, E4, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetFolderCustomSettingsW + B2 7CA1DC7F 34 Bytes [ F6, D9, 1B, C9, 23, 4D, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetFolderCustomSettingsW + D5 7CA1DCA2 14 Bytes CALL 7CA197C3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSetFolderCustomSettingsW + E5 7CA1DCB2 43 Bytes [ F6, 46, 44, 01, 0F, 85, C4, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetLocalizedName + 6 7CA21652 8 Bytes [ 6C, 24, 04, 08, E9, D2, F5, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetLocalizedName + F 7CA2165B 28 Bytes [ 90, 90, 90, 90, 90, 83, 6C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetLocalizedName + 2D 7CA21679 28 Bytes [ 90, 90, 90, 90, 90, 83, 6C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetLocalizedName + 4B 7CA21697 57 Bytes [ F6, C3, 03, 74, 12, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetLocalizedName + 85 7CA216D1 14 Bytes JMP 7CA0F4F3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushSFCache + 32 7CA217B0 59 Bytes [ 85, C0, 0F, 84, 86, 18, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushSFCache + 6E 7CA217EC 52 Bytes [ 75, 10, 0F, 84, 0D, 37, 03, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushSFCache + A3 7CA21821 86 Bytes [ 00, 90, 90, 90, 90, 90, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushSFCache + FA 7CA21878 102 Bytes [ 33, C0, 89, 9D, DC, FD, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushSFCache + 161 7CA218DF 4 Bytes [ FD, FF, FF, 8D ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIcon + B 7CA221E1 45 Bytes [ 83, BD, 3C, F5, FF, FF, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIcon + 39 7CA2220F 7 Bytes [ FF, 00, 09, 8D, 28, F5, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIcon + 41 7CA22217 18 Bytes [ 89, 85, 58, F5, FF, FF, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIcon + 54 7CA2222A 8 Bytes [ FF, 8B, F8, 85, FF, 7C, 23, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIcon + 5D 7CA22233 2 Bytes [ 24, F5 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Lock + 6 7CA228EB 9 Bytes [ FF, 8B, CB, 50, 0F, 84, F9, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Lock + 10 7CA228F5 66 Bytes [ FF, B5, BC, F9, FF, FF, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Lock + 53 7CA22938 144 Bytes [ 8B, 4D, FC, 8B, 85, C0, F9, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Lock + E4 7CA229C9 2 Bytes [ EC, 56 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Lock + E7 7CA229CC 47 Bytes [ 75, 08, FF, 71, 3C, E8, 3F, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractVersionResource16W + 11 7CA22C52 5 Bytes [ FC, FF, C9, C2, 04 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractVersionResource16W + 17 7CA22C58 9 Bytes [ 83, 0E, 18, EB, D5, C7, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractVersionResource16W + 22 7CA22C63 114 Bytes [ A1, 60, FA, BC, 7C, 33, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractVersionResource16W + 96 7CA22CD7 36 Bytes [ 00, FF, 15, 7C, 1A, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractVersionResource16W + BB 7CA22CFC 1 Byte [ 52 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllCanUnloadNow + 27 7CA238B4 15 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllCanUnloadNow + 37 7CA238C4 46 Bytes [ 57, 8B, 7D, 08, F7, 47, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllCanUnloadNow + 66 7CA238F3 31 Bytes [ 00, 00, 85, C0, 74, 16, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllCanUnloadNow + 86 7CA23913 162 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllCanUnloadNow + 129 7CA239B6 4 Bytes [ 55, 8B, EC, 56 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsExe + 2 7CA23A9F 3 Bytes JMP 7CA2397C C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsExe + 6 7CA23AA3 108 Bytes [ FF, 39, 7D, F4, 0F, 85, F1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsExe + 73 7CA23B10 30 Bytes JMP 7CA23893 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsExe + 92 7CA23B2F 8 Bytes JMP 7CA26B44 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsExe + 9B 7CA23B38 24 Bytes [ 40, 04, 8B, 34, 98, 3B, FE, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsLFNDrive + 3B 7CA23DCC 54 Bytes [ 69, 00, 6E, 00, 69, 00, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsLFNDrive + 72 7CA23E03 96 Bytes [ 83, C6, 04, 81, FE, 2C, 59, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsLFNDrive + D3 7CA23E64 20 Bytes [ 9E, 7C, 0F, 85, 72, 01, 02, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsLFNDrive + E8 7CA23E79 77 Bytes [ 5E, C3, 90, 90, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsLFNDrive + 136 7CA23EC7 28 Bytes [ 0F, 85, 1A, 1A, 02, 00, C3, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Unlock + 5 7CA24415 89 Bytes [ A1, 54, FA, BC, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Unlock + 5F 7CA2446F 19 Bytes [ FF, 8B, 45, 08, 3B, C3, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Unlock + 73 7CA24483 3 Bytes [ CE, FF, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Unlock + 77 7CA24487 17 Bytes [ 8B, F8, 3B, FB, 74, 23, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotification_Unlock + 8B 7CA2449B 2 Bytes [ FF, 15 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotify + B 7CA24914 3 Bytes [ 68, 64, FA ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotify + 10 7CA24919 50 Bytes CALL 7CA00BA3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotify + 43 7CA2494C 118 Bytes [ 68, A4, FA, BC, 7C, E8, 4D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotify + BA 7CA249C3 16 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotify + CB 7CA249D4 26 Bytes [ 00, F6, 45, 08, 01, 74, 07, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIconW + 41 7CA2A570 7 Bytes [ 64, 00, 52, 00, 75, 00, 6E ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIconW + 49 7CA2A578 1 Byte [ 44 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIconW + 4B 7CA2A57A 41 Bytes [ 6C, 00, 6C, 00, 00, 00, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIconW + 75 7CA2A5A4 115 Bytes [ 63, 00, 64, 00, 6C, 00, 67, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Shell_NotifyIconW + E9 7CA2A618 74 Bytes [ 75, 00, 63, 00, 74, 00, 69, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListW + 17 7CA2AAD0 122 Bytes [ A2, 7C, C3, 90, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListW + 92 7CA2AB4B 8 Bytes [ 07, BD, 7C, C0, A0, A2, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListW + 9B 7CA2AB54 58 Bytes [ 90, 90, 90, 90, C7, 05, F0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListW + D6 7CA2AB8F 1 Byte [ A0 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListW + D8 7CA2AB91 94 Bytes [ 7C, C3, 90, 90, 90, 90, 90, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathA + FB 7CA2AD0C 5 Bytes [ BD, 7C, C0, A0, A2 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathA + 101 7CA2AD12 43 Bytes [ C3, 90, 90, 90, 90, 90, C7, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathA + 12D 7CA2AD3E 19 Bytes [ C0, A0, A2, 7C, C3, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathA + 141 7CA2AD52 17 Bytes [ C3, 90, 90, 90, 90, 90, C7, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathA + 154 7CA2AD65 77 Bytes [ 90, 90, 90, C7, 05, 14, 09, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfoW + 4D 7CA2B040 89 Bytes [ 3D, D0, F5, BC, 7C, 74, 0D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfoW + A7 7CA2B09A 72 Bytes [ 94, AB, 01, 00, A1, 2C, 09, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfoW + F0 7CA2B0E3 106 Bytes [ A1, 58, F5, BC, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfoW + 15B 7CA2B14E 5 Bytes [ 00, E8, 0B, 00, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfoW + 161 7CA2B154 64 Bytes [ 33, C0, 5D, C2, 0C, 00, 90, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragAcceptFiles + 14 7CA2B1BD 19 Bytes [ D8, 0D, 00, A2, A2, 7C, 89, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragAcceptFiles + 28 7CA2B1D1 155 Bytes [ 8B, 38, 4F, 78, 1C, 56, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragAcceptFiles + C4 7CA2B26D 49 Bytes [ 55, 8B, EC, 53, 56, 57, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragAcceptFiles + F6 7CA2B29F 16 Bytes [ 5F, 5E, 5B, 5D, C2, 10, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragAcceptFiles + 107 7CA2B2B0 9 Bytes [ 90, 90, 90, 90, 8B, FF, 55, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetMalloc + 43 7CA2B3D8 16 Bytes [ 80, FF, 15, 30, 10, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetMalloc + 54 7CA2B3E9 9 Bytes [ 10, 9C, 7C, 8B, C6, 5E, 5D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetMalloc + 5E 7CA2B3F3 8 Bytes [ 33, F6, 46, EB, F4, B8, 17, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetMalloc + 67 7CA2B3FC 14 Bytes [ 00, 3B, F8, 0F, 86, 80, 87, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetMalloc + 76 7CA2B40B 13 Bytes [ 72, 40, 81, FF, 12, 02, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILSaveToStream + 54 7CA2F480 28 Bytes [ 03, 56, 56, FF, 75, CC, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILSaveToStream + 73 7CA2F49F 82 Bytes [ 85, FF, C7, 45, FC, 01, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILSaveToStream + C6 7CA2F4F2 52 Bytes [ 00, C7, 45, D4, 02, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILSaveToStream + FB 7CA2F527 50 Bytes [ 75, F4, 8B, 46, 18, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILSaveToStream + 12F 7CA2F55B 26 Bytes [ 8D, B7, B4, 01, 00, 00, 8B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAddToRecentDocs + 7 7CA2FD29 42 Bytes [ FF, 15, E0, 15, 9C, 7C, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAddToRecentDocs + 32 7CA2FD54 20 Bytes [ FF, 55, 8B, EC, 56, 8B, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAddToRecentDocs + 47 7CA2FD69 76 Bytes [ C0, 74, 12, 8B, CF, 8B, D1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAddToRecentDocs + 94 7CA2FDB6 45 Bytes [ 55, 8B, EC, 81, EC, 98, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAddToRecentDocs + C2 7CA2FDE4 2 Bytes [ 9D, 70 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Win32DeleteFile + 4B 7CA30510 4 Bytes [ 84, 4C, 48, 02 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Win32DeleteFile + 50 7CA30515 54 Bytes [ 56, 57, 6A, 60, 6A, 40, BF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Win32DeleteFile + 87 7CA3054C 36 Bytes CALL 7CA304A2 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Win32DeleteFile + AC 7CA30571 16 Bytes [ 55, 8B, EC, 56, FF, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Win32DeleteFile + BD 7CA30582 13 Bytes [ 15, 58, 18, 9C, 7C, 85, C0, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathYetAnotherMakeUniqueName + 6B 7CA308F4 12 Bytes [ 0A, 00, 89, B5, C6, FB, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathYetAnotherMakeUniqueName + 78 7CA30901 78 Bytes [ FF, 8D, BD, C4, FB, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathYetAnotherMakeUniqueName + C7 7CA30950 56 Bytes [ FF, 55, 8B, EC, 51, 56, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathYetAnotherMakeUniqueName + 100 7CA30989 14 Bytes [ 5E, C9, C2, 08, 00, 8D, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathYetAnotherMakeUniqueName + 10F 7CA30998 1 Byte [ FF ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathCleanupSpec + 33 7CA30A9F 63 Bytes [ FF, 6A, 00, 50, 6A, 00, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathCleanupSpec + 73 7CA30ADF 12 Bytes [ F3, 33, C0, F3, A7, 0F, 84, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathCleanupSpec + 80 7CA30AEC 4 Bytes [ B5, D0, FD, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathCleanupSpec + 85 7CA30AF1 18 Bytes CALL 7C9EEF16 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathCleanupSpec + 98 7CA30B04 37 Bytes [ 8D, 95, DC, FB, FF, FF, 52, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfoW + 20 7CA30B2A 16 Bytes [ 08, 50, FF, 51, 10, 8B, F0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfoW + 31 7CA30B3B 39 Bytes [ 51, 08, 81, FE, 01, 40, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfoW + 59 7CA30B63 53 Bytes [ 8D, 44, 43, 02, 51, 50, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfoW + 8F 7CA30B99 12 Bytes [ FF, A5, A5, A5, A5, C7, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfoW + 9C 7CA30BA6 26 Bytes [ 00, 00, 8B, 85, D4, F5, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrIW + 58 7CA311BF 106 Bytes JMP 7C9FF007 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrIW + C4 7CA3122B 5 Bytes [ 53, 8D, 45, FC, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrIW + CA 7CA31231 45 Bytes [ 75, 0C, 8B, CE, FF, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrIW + F8 7CA3125F 33 Bytes [ 75, 08, FF, 75, 0C, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrIW + 11A 7CA31281 31 Bytes [ 75, 10, FF, 15, 34, 16, 9C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfo + 1 7CA31552 47 Bytes [ 4D, 10, 56, 8B, 75, 0C, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfo + 31 7CA31582 16 Bytes [ 50, 8D, 85, F4, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfo + 42 7CA31593 4 Bytes [ 8C, 9C, 00, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfo + 47 7CA31598 30 Bytes [ 83, BD, F0, FD, FF, FF, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFileInfo + 66 7CA315B7 14 Bytes CALL 7C9EBD8F C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconW + 63 7CA318A1 17 Bytes [ 5D, 14, 89, 85, C0, F7, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconW + 75 7CA318B3 11 Bytes [ B5, D0, F7, FF, FF, 89, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconW + 81 7CA318BF 1 Byte [ 9D ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconW + 83 7CA318C1 78 Bytes [ F7, FF, FF, 0F, 84, BF, 2F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconW + D2 7CA31910 1 Byte [ D7 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILGetNext + 2B 7CA3449A 10 Bytes [ 50, FF, 75, 10, FF, B5, E0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILGetNext + 36 7CA344A5 2 Bytes [ CE, B0 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILGetNext + 3A 7CA344A9 21 Bytes [ FF, B5, E0, F9, FF, FF, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILGetNext + 50 7CA344BF 15 Bytes [ FF, 8D, 85, F4, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILGetNext + 60 7CA344CF 15 Bytes [ 4D, FC, 5F, 8B, C6, 5E, 5B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ReadCabinetState + 2C 7CA346FD 54 Bytes [ C2, 10, 00, 90, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ReadCabinetState + 63 7CA34734 71 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ReadCabinetState + AB 7CA3477C 3 Bytes [ B6, 68, FB ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ReadCabinetState + AF 7CA34780 27 Bytes [ 85, C0, 59, 74, 35, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ReadCabinetState + CB 7CA3479C 84 Bytes [ 8B, 06, 57, FF, 75, 10, 68, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDList + 21 7CA34C52 94 Bytes [ 66, 00, 00, FF, 76, 28, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDList + 80 7CA34CB1 4 Bytes [ 75, 0C, 8B, D9 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDList + 85 7CA34CB6 53 Bytes CALL 7CA34BEF C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDList + BB 7CA34CEC 215 Bytes [ F9, FF, 15, D4, 15, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetPathFromIDList + 193 7CA34DC4 61 Bytes [ 00, 0F, 85, 58, 4A, 02, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgReadMultiple + 1 7CA37A62 30 Bytes [ C7, 5F, 5E, 5D, C2, 0C, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgReadMultiple + 20 7CA37A81 95 Bytes CALL 7CA3796E C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgReadMultiple + 80 7CA37AE1 94 Bytes [ FF, 75, 10, 8B, 06, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgReadMultiple + DF 7CA37B40 82 Bytes [ FF, FF, 90, 90, 4D, 6B, A3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgReadMultiple + 132 7CA37B93 19 Bytes [ F2, 33, DB, F3, A7, 74, 05, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetRealIDL + 17 7CA38DC8 46 Bytes [ EC, 81, EC, 10, 02, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetRealIDL + 46 7CA38DF7 18 Bytes [ 80, 00, 00, 3B, F8, 0F, 8F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetRealIDL + 59 7CA38E0A 35 Bytes [ 00, 02, 00, 00, 0F, 84, 6B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetRealIDL + 7D 7CA38E2E 2 Bytes [ 00, 20 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetRealIDL + 81 7CA38E32 50 Bytes [ 0F, 84, 47, 10, 00, 00, 6A, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExecutableA + B 7CA3FA07 28 Bytes [ 00, 6A, 06, FF, B0, B0, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExecutableA + 28 7CA3FA24 101 Bytes [ 51, 14, 85, DB, 0F, 8C, DC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExecutableW + 5 7CA3FA93 57 Bytes [ 56, 57, 6A, 00, 8B, F1, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExecutableW + 40 7CA3FACE 17 Bytes [ 8B, 45, 24, 8D, BE, 38, 02, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExecutableW + 52 7CA3FAE0 48 Bytes [ 00, FF, 75, 18, 89, 86, 3C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExecutableW + 83 7CA3FB11 14 Bytes [ 55, 8B, EC, 56, 57, 68, 40, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExecutableW + 92 7CA3FB20 5 Bytes [ 85, C0, 59, 74, 55 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSettings + 14 7CA3FBC1 32 Bytes [ 00, 8B, C7, 5F, 5E, 5D, C2, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSettings + 35 7CA3FBE2 17 Bytes [ 43, 3B, C3, B9, 05, 40, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSettings + 47 7CA3FBF4 8 Bytes [ F8, 03, 0F, 84, 43, 84, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSettings + 50 7CA3FBFD 19 Bytes [ C0, 75, 50, 53, 56, FF, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetSettings + 64 7CA3FC11 13 Bytes [ 39, 1E, 75, 18, 8B, 47, 0C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteW + 26 7CA409C0 5 Bytes [ 04, 31, D1, EA, 52 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteW + 2C 7CA409C6 5 Bytes [ 6A, FF, 89, 04, BE ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteW + 32 7CA409CC 26 Bytes [ 45, FC, FF, 30, 6A, 00, 6A, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteW + 4D 7CA409E7 58 Bytes [ 8B, 45, FC, 47, 3B, 7D, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteW + 88 7CA40A22 82 Bytes [ FF, FF, 33, DB, 8B, F8, 83, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstW + 37 7CA40D96 7 Bytes JMP 7CA4DF23 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstW + 3F 7CA40D9E 85 Bytes [ 83, 7D, FC, 02, 5F, 5E, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstW + 95 7CA40DF4 26 Bytes [ 8B, F0, 8D, 84, 3E, 09, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstW + B0 7CA40E0F 25 Bytes [ 15, 28, 16, 9C, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteEx + 4 7CA40E29 38 Bytes [ 7D, 08, 83, C0, F6, 89, 43, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteEx + 2B 7CA40E50 48 Bytes [ 5E, 25, 0E, 00, 07, 80, 5B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteEx + 5C 7CA40E81 68 Bytes [ 15, 80, 14, 9C, 7C, 57, 68, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteEx + A1 7CA40EC6 88 Bytes [ 2B, 45, 0C, 1B, 55, 10, 89, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteEx + FA 7CA40F1F 7 Bytes [ 55, 8B, EC, 51, 56, 8B, F1 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteA + 4B 7CA4119B 1 Byte [ 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteA + 4D 7CA4119D 12 Bytes CALL 7C9E83EC C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteA + 5A 7CA411AA 64 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteA + 9B 7CA411EB 50 Bytes [ 08, FF, 15, B8, 1D, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteA + CE 7CA4121E 19 Bytes [ F8, 50, 68, C0, 51, 9C, 7C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CommandLineToArgvW + 1 7CA41349 9 Bytes CALL 7C9E8480 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CommandLineToArgvW + B 7CA41353 150 Bytes [ 90, 90, 90, 90, 90, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CommandLineToArgvW + A2 7CA413EA 9 Bytes [ 83, 7E, 20, 00, 57, 0F, 84, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CommandLineToArgvW + AD 7CA413F5 78 Bytes [ FF, 15, 08, 1E, 9C, 7C, 68, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CommandLineToArgvW + FC 7CA41444 77 Bytes [ 5D, 08, 56, 57, 8B, F1, 56, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + A 7CA41F80 84 Bytes [ 8B, FF, 55, 8B, EC, 33, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + 5F 7CA41FD5 1 Byte [ 39 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + 6F 7CA41FE5 53 Bytes [ 8B, F0, 8D, 7D, EC, A5, A5, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + A5 7CA4201B 80 Bytes CALL 7C9F7D79 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + F6 7CA4206C 70 Bytes [ 61, 00, 6D, 00, 65, 00, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellAboutW + 3F 7CA62EAE 118 Bytes [ 6C, 00, 2C, 00, 2D, 00, 36, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellAboutA + 67 7CA62F25 70 Bytes [ 00, 90, 90, 78, 00, 70, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellAboutA + AE 7CA62F6C 31 Bytes [ 00, 00, 90, 90, 70, 00, 6F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellAboutA + CE 7CA62F8C 27 Bytes [ 32, 00, 30, 00, 32, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellAboutA + EA 7CA62FA8 3 Bytes [ 6C, 00, 6C ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellAboutA + EE 7CA62FAC 107 Bytes [ 2C, 00, 30, 00, 00, 00, 90, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHQueryRecycleBinW + 55 7CA66925 62 Bytes [ FF, FF, 15, B0, 1C, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHQueryRecycleBinA + 2 7CA66964 33 Bytes [ 15, AC, 15, 9C, 7C, 8D, 86, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHQueryRecycleBinA + 24 7CA66986 21 Bytes [ 15, 44, 19, 9F, 7C, 83, F8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHQueryRecycleBinA + 3A 7CA6699C 19 Bytes [ FF, 50, FF, 75, 14, E8, 7B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHQueryRecycleBinA + 4E 7CA669B0 2 Bytes [ 8D, 85 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHQueryRecycleBinA + 51 7CA669B3 66 Bytes [ FB, FF, FF, FF, 75, 10, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinW + 2 7CA66C63 6 Bytes [ FF, 53, E8, 3C, EE, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinW + 9 7CA66C6A 30 Bytes [ 39, B5, DC, F9, FF, FF, 74, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinW + 29 7CA66C8A 31 Bytes [ 18, 01, 00, 00, 74, 08, 39, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinW + 4A 7CA66CAB 14 Bytes CALL 7CA640C7 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinW + 59 7CA66CBA 62 Bytes [ 8D, 1C, 9D, C0, 58, BD, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinA + 2E 7CA66CF9 89 Bytes [ 35, A4, F5, BC, 7C, E8, 6E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinA + 88 7CA66D53 110 Bytes [ 56, 0F, 94, C1, 56, 56, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinA + F7 7CA66DC2 55 Bytes [ FF, 0F, 94, C0, 89, 41, 18, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinA + 12F 7CA66DFA 9 Bytes [ 56, 57, 8B, 7D, 08, 89, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEmptyRecycleBinA + 139 7CA66E04 5 Bytes [ FF, 8D, 85, DC, F7 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateStdEnumFmtEtc + 18 7CA66E42 112 Bytes [ 85, C0, 0F, 84, 4A, 02, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateStdEnumFmtEtc + 89 7CA66EB3 183 Bytes [ 8D, 85, DC, F7, FF, FF, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateStdEnumFmtEtc + 141 7CA66F6B 24 Bytes [ D8, BE, 04, 01, 00, 00, 56, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateStdEnumFmtEtc + 15A 7CA66F84 13 Bytes [ 08, FE, FF, FF, 50, 57, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateStdEnumFmtEtc + 168 7CA66F92 3 Bytes [ 32, 68, AC ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WriteCabinetState + 7E 7CA6718D 54 Bytes [ 15, 88, 1C, 9C, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WriteCabinetState + B5 7CA671C4 15 Bytes [ FF, 00, EB, 0C, FF, 15, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WriteCabinetState + C5 7CA671D4 135 Bytes [ 83, BD, BC, F7, FF, FF, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WriteCabinetState + 14D 7CA6725C 7 Bytes [ 15, 60, 1C, 9C, 7C, 57, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WriteCabinetState + 155 7CA67264 39 Bytes [ B5, D8, F7, FF, FF, 89, 85, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFreeNameMappings + 2E 7CA690F7 59 Bytes [ FF, 89, 9E, 18, 02, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFreeNameMappings + 6A 7CA69133 22 Bytes [ 07, 3B, C3, 74, 09, 50, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFreeNameMappings + 81 7CA6914A 19 Bytes [ 15, F4, 15, 9C, 7C, 89, 5E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFreeNameMappings + 95 7CA6915E 19 Bytes [ 8B, FF, 55, 8B, EC, 83, EC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFreeNameMappings + A9 7CA69172 20 Bytes [ 76, 04, 33, DB, 89, 5D, FC, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectory + 7 7CA6A8D4 1 Byte [ 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectory + 9 7CA6A8D6 18 Bytes [ 41, 56, 8B, 75, 08, 57, 6A, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExA + 1 7CA6A8E9 15 Bytes CALL 7CA6A787 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExA + 11 7CA6A8F9 23 Bytes [ FF, 15, 64, 1D, 9C, 7C, 6A, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExA + 29 7CA6A911 50 Bytes [ 15, DC, 1D, 9C, 7C, 5F, 5E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExA + 5D 7CA6A945 22 Bytes [ 00, 8B, 51, 34, 85, D2, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateDirectoryExA + 74 7CA6A95C 96 Bytes [ D7, FF, B6, EC, 00, 00, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperationW + 24 7CA70860 27 Bytes [ 00, 8B, 86, A4, 00, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperationW + 41 7CA7087D 225 Bytes [ 00, C7, 46, 3C, 01, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperationW + 123 7CA7095F 11 Bytes [ A1, 48, F5, BC, 7C, 53, 56, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperationW + 12F 7CA7096B 8 Bytes [ FC, 8B, 45, 0C, 57, 8B, D8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperationW + 138 7CA70974 56 Bytes [ 40, 85, C0, BF, 00, 01, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperation + 4B 7CA70B6F 41 Bytes [ FF, 8D, 85, F4, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperation + 75 7CA70B99 67 Bytes [ 85, F4, FD, FF, FF, 50, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperation + B9 7CA70BDD 56 Bytes [ FF, EB, 2B, 8B, 3D, AC, 1C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperation + F2 7CA70C16 16 Bytes [ FF, 8B, 46, 40, 85, C0, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFileOperation + 103 7CA70C27 36 Bytes [ FF, 00, 01, 00, 00, 75, 19, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLL + 3D 7CA716A5 27 Bytes JMP 7CA71315 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLL + 59 7CA716C1 88 Bytes [ 00, 50, 8D, 86, F4, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLL + B2 7CA7171A 5 Bytes [ 50, 8D, 86, F4, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLL + B9 7CA71721 91 Bytes CALL 7CA6BA0F C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLLW + 20 7CA7177D 38 Bytes [ B5, 04, F9, FF, FF, E8, AD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLLW + 47 7CA717A4 29 Bytes [ 83, F8, FF, 74, 11, 8D, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLLW + 65 7CA717C2 11 Bytes [ FF, 68, 04, 01, 00, 00, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLLW + 71 7CA717CE 7 Bytes [ 8D, 85, B4, FD, FF, FF, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_FillCache_RunDLLW + 79 7CA717D6 108 Bytes [ 15, AC, 1C, 9C, 7C, 56, 8D, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHRunControlPanel + 11 7CA72336 5 Bytes [ 5D, C2, 1C, 00, 90 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHRunControlPanel + 1A 7CA7233F 40 Bytes [ 8B, FF, 55, 8B, EC, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_RunDLL + 28 7CA72368 99 Bytes [ 5D, C2, 1C, 00, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_RunDLLW + 33 7CA723CC 72 Bytes [ 75, 34, 0F, B7, C0, 50, 53, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_RunDLLAsUserW + 23 7CA72415 29 Bytes [ 90, 90, 90, 90, 8B, FF, 55, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_RunDLLAsUserW + 41 7CA72433 67 Bytes [ 0C, 53, 8B, 5D, 08, 89, 45, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_RunDLLAsUserW + 85 7CA72477 45 Bytes [ 85, DB, 74, 0D, 6A, 20, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_RunDLLAsUserW + B3 7CA724A5 62 Bytes [ 9C, 7C, 8B, 45, B4, 8B, 4D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Control_RunDLLAsUserW + F2 7CA724E4 25 Bytes [ D7, 66, 85, C0, 66, 89, 06, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconEx + 7 7CA72A4D 25 Bytes CALL 7CA72A4F C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DuplicateIcon + 10 7CA72A67 32 Bytes [ FF, 7C, AE, 3B, 9D, F0, FD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DuplicateIcon + 31 7CA72A88 6 Bytes [ FF, 83, 20, 00, EB, 4D ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DuplicateIcon + 38 7CA72A8F 85 Bytes [ B5, E0, FD, FF, FF, 85, F6, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DuplicateIcon + 8E 7CA72AE5 25 Bytes [ 59, F7, FF, C9, C2, 10, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DuplicateIcon + A8 7CA72AFF 24 Bytes [ 04, 56, 89, 75, FC, FF, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FreeIconList + C 7CA72B19 22 Bytes [ 89, 75, 08, FF, B6, 88, CC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FreeIconList + 23 7CA72B30 88 Bytes [ 86, 8C, CC, 9D, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoW + 1B 7CA72B89 53 Bytes [ B6, 94, CC, 9D, 7C, 57, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoW + 51 7CA72BBF 28 Bytes [ 6A, 00, FF, 75, FC, FF, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoW + 6E 7CA72BDC 40 Bytes [ A1, 48, F5, BC, 7C, 53, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoW + 97 7CA72C05 15 Bytes CALL 7C9ED058 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoW + A7 7CA72C15 38 Bytes [ 00, 68, 01, 26, 00, 00, 53, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoA + 11 7CA73088 24 Bytes [ F3, AB, 68, 08, 02, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoA + 2A 7CA730A1 6 Bytes [ FF, 50, 8D, 85, D4, F7 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoA + 32 7CA730A9 29 Bytes CALL 7CA728BC C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconResInfoA + 50 7CA730C7 49 Bytes [ FF, 50, 68, 19, 00, 02, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExW + 17 7CA730FA 23 Bytes [ FF, 15, 30, 1C, 9C, 7C, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExW + 2F 7CA73112 3 Bytes [ 4D, FC, 5F ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExW + 33 7CA73116 6 Bytes [ C6, 5E, E8, D3, 52, F7 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExW + 3A 7CA7311D 42 Bytes [ C9, C2, 04, 00, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExW + 65 7CA73148 3 Bytes [ 85, F4, FD ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExA + 20 7CA732CE 10 Bytes [ 75, 0C, FF, 75, 10, 53, 56, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExA + 2D 7CA732DB 24 Bytes [ F8, 56, FF, 15, 34, 16, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExA + 48 7CA732F6 57 Bytes [ 00, 74, 16, FF, B5, EC, FD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExA + 82 7CA73330 5 Bytes [ 75, 08, E8, 1C, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconExA + 89 7CA73337 121 Bytes [ 5D, C2, 08, 00, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconW + 10 7CA733B1 115 Bytes [ 68, 08, 02, 00, 00, 89, 45, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconA + 26 7CA73425 8 Bytes [ 53, 8B, 5D, 10, 56, 8B, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractIconA + 2F 7CA7342E 63 Bytes [ 8B, 7D, 0C, 89, 45, FC, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListW + C 7CA7346F 10 Bytes [ 33, C0, 40, EB, 05, 83, 26, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListW + 17 7CA7347A 36 Bytes [ 4D, FC, 5F, 5E, 5B, E8, 6C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListW + 3C 7CA7349F 36 Bytes [ 33, C0, F3, A7, 74, 1E, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!InternalExtractIconListW + 61 7CA734C4 211 Bytes [ 75, 08, 8D, 46, 04, 50, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconA + 2B 7CA73598 14 Bytes [ 40, 04, 89, 48, 10, 8B, 4D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconA + 3A 7CA735A7 26 Bytes [ 48, 0C, 89, 03, 33, C0, EB, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconA + 55 7CA735C2 10 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconA + 60 7CA735CD 51 Bytes [ 6A, 10, 33, C0, 33, C9, 5E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ExtractAssociatedIconA + 94 7CA73601 31 Bytes [ 55, 8B, EC, 83, EC, 34, 8B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstA + 4 7CA736B6 53 Bytes [ D1, 0F, AF, D1, 03, D0, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstA + 3A 7CA736EC 114 Bytes [ FF, 89, 45, FC, EB, 40, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstA + AD 7CA7375F 50 Bytes [ 8D, 45, CC, 50, FF, 15, 28, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DoEnvironmentSubstA + E0 7CA73792 174 Bytes CALL CCF7F7CA
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceA + 99 7CA73841 38 Bytes [ 15, 14, 11, 9C, 7C, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceA + C1 7CA73869 2 Bytes [ 48, 11 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceA + C6 7CA7386E 37 Bytes [ 3D, 4C, 12, 9C, 7C, 50, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceA + EC 7CA73894 43 Bytes [ D3, 8B, D8, 53, FF, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDiskFreeSpaceA + 118 7CA738C0 37 Bytes [ 38, 8B, 45, 1C, FF, 30, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHHelpShortcuts_RunDLLW + B 7CA739DD 36 Bytes [ 75, F4, 48, 50, FF, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHObjectProperties + 20 7CA73A02 26 Bytes [ FF, 75, FC, FF, 75, F8, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHObjectProperties + 3B 7CA73A1D 13 Bytes [ 15, 40, 12, 9C, 7C, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHObjectProperties + 83 7CA73A65 25 Bytes [ 0C, FF, 15, 48, 1E, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHObjectProperties + 9D 7CA73A7F 10 Bytes [ 8B, 35, 54, 12, 9C, 7C, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHObjectProperties + AA 7CA73A8C 39 Bytes [ FF, D6, 8B, C7, 5F, 5E, C9, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellMessageBoxA + 2 7CA73E03 17 Bytes [ FF, 66, 89, 01, C7, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellMessageBoxA + 15 7CA73E16 24 Bytes [ 66, 39, 5D, 10, 0F, 85, 1C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellMessageBoxA + 2E 7CA73E2F 37 Bytes [ FF, D7, 83, F8, 04, 0F, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellMessageBoxA + 54 7CA73E55 56 Bytes [ FF, 6B, C0, 0E, 83, C0, 06, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellMessageBoxA + 8E 7CA73E8F 1 Byte [ 66 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushClipboard + D 7CA73EDC 21 Bytes [ FF, FF, 15, F0, 14, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushClipboard + 23 7CA73EF2 10 Bytes [ 8B, BD, D8, FD, FF, FF, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushClipboard + 2E 7CA73EFD 11 Bytes [ FF, 8B, 95, D8, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushClipboard + 3A 7CA73F09 36 Bytes [ FF, 0E, 8D, B5, E4, FD, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFlushClipboard + 5F 7CA73F2E 13 Bytes [ 89, 85, DC, FD, FF, FF, 72, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowA + 38 7CA74BB9 7 Bytes [ 75, 08, 89, 5D, D8, FF, D6 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowA + 40 7CA74BC1 42 Bytes [ 75, 08, FF, 15, 54, 1E, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowA + 6B 7CA74BEC 118 Bytes [ 75, 08, FF, 15, B8, 1D, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowA + E2 7CA74C63 6 Bytes [ 90, 90, 90, 90, 90, 8B ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathIsSlowA + E9 7CA74C6A 58 Bytes [ 55, 8B, EC, FF, 75, 0C, 6A, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathGetShortPath + 2 7CA74F80 33 Bytes [ 8B, 45, 08, 8B, 00, 3B, C3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathGetShortPath + 24 7CA74FA2 38 Bytes [ 75, 10, 8B, 7D, 0C, 68, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathGetShortPath + 4B 7CA74FC9 55 Bytes [ DE, 1B, F6, 46, 5F, 8B, C6, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathGetShortPath + 83 7CA75001 31 Bytes [ 85, C0, 74, 16, FF, 75, 18, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathGetShortPath + A3 7CA75021 56 Bytes [ F6, 7D, 07, 57, FF, 15, 20, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsLFNDriveA + 24 7CA7511E 28 Bytes [ 8D, 45, EC, 50, FF, 15, 38, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!IsLFNDriveA + 41 7CA7513B 18 Bytes [ 55, 8B, EC, 81, EC, 14, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathQualify + B 7CA7514F 40 Bytes [ 10, 89, 45, FC, 8B, 45, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathQualify + 34 7CA75178 44 Bytes CALL 7C9F3BB4 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathQualify + 61 7CA751A5 50 Bytes [ FF, A1, A4, 5D, BD, 7C, 3B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathQualify + 95 7CA751D9 10 Bytes [ 04, 00, 00, 00, 89, 9D, 54, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathQualify + A0 7CA751E4 22 Bytes [ D7, 85, C0, 75, 14, 83, BD, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathMakeUniqueName + 12 7CA7553E 19 Bytes [ 08, 68, 98, 45, A7, 7C, 68, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathMakeUniqueName + 26 7CA75552 7 Bytes [ FF, 85, C0, 75, 29, 68, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathMakeUniqueName + 2E 7CA7555A 29 Bytes CALL 7C9ED057 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathMakeUniqueName + 4C 7CA75578 2 Bytes [ E2, F9 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PathMakeUniqueName + 4F 7CA7557B 42 Bytes [ FF, 85, C0, 75, 04, 33, C0, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PickIconDlg + 19 7CA763E0 29 Bytes [ 7D, 08, 89, 95, E0, FB, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PickIconDlg + 37 7CA763FE 7 Bytes [ 45, 0C, 8B, BD, D4, FB, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PickIconDlg + 3F 7CA76406 4 Bytes [ 8B, 9D, D0, FB ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PickIconDlg + 44 7CA7640B 10 Bytes [ FF, 03, C0, 89, 85, C8, FB, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PickIconDlg + 4F 7CA76416 17 Bytes [ B5, DC, FB, FF, FF, 2B, C7, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHInvokePrinterCommandA + 5B 7CA77241 10 Bytes [ 15, 98, 1D, 9C, 7C, E9, E1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHInvokePrinterCommandA + 66 7CA7724C 58 Bytes [ 35, 50, 1D, 9C, 7C, 6A, 0B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHInvokePrinterCommandA + A1 7CA77287 18 Bytes [ 15, 30, 11, 9C, 7C, 33, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHInvokePrinterCommandA + B4 7CA7729A 8 Bytes [ 76, 18, FF, 15, 2C, 11, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHInvokePrinterCommandA + BD 7CA772A3 247 Bytes CALL 7CA1BEDE C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PrintersGetCommand_RunDLL + 28 7CA7739B 168 Bytes [ 56, 89, 07, FF, 15, 34, 16, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PrintersGetCommand_RunDLLW + 4C 7CA77444 2 Bytes [ 75, 10 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PrintersGetCommand_RunDLLW + 4F 7CA77447 3 Bytes [ 45, F4, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PrintersGetCommand_RunDLLW + 53 7CA7744B 8 Bytes [ 75, F8, FF, 75, FC, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PrintersGetCommand_RunDLLW + 5C 7CA77454 8 Bytes [ 75, 08, FF, 75, 18, FF, 55, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PrintersGetCommand_RunDLLW + 66 7CA7745E 64 Bytes [ 75, 2E, FF, D3, 83, F8, 7A, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAddFromPropSheetExtArray + 2 7CA77818 109 Bytes [ 3C, 00, 00, 00, C7, 85, 54, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHReplaceFromPropSheetExtArray + 18 7CA77886 74 Bytes [ F8, FF, 15, 00, 10, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHReplaceFromPropSheetExtArray + 63 7CA778D1 78 Bytes [ 80, 00, 00, 56, 89, 85, E4, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHReplaceFromPropSheetExtArray + B2 7CA77920 7 Bytes [ C7, 74, 38, 66, 39, 38, 74 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHReplaceFromPropSheetExtArray + BA 7CA77928 79 Bytes CALL 7CA349D3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHReplaceFromPropSheetExtArray + 10B 7CA77979 5 Bytes [ 50, E8, D0, 73, 04 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreatePropSheetExtArray + 20 7CA77A66 95 Bytes [ D6, 8D, 44, 00, 02, 01, 45, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreatePropSheetExtArray + 80 7CA77AC6 14 Bytes [ C6, 5B, 5F, 5E, C9, C2, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreatePropSheetExtArray + 8F 7CA77AD5 104 Bytes [ 55, 8B, EC, 6A, 00, 68, 4F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreatePropSheetExtArray + F8 7CA77B3E 70 Bytes [ 55, 8B, EC, 81, EC, 3C, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreatePropSheetExtArray + 13F 7CA77B85 21 Bytes [ FF, FF, D7, 8D, 85, EC, FB, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryPoint + 1E 7CA77BD9 69 Bytes [ 34, 16, 9C, 7C, EB, 0C, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragFinish + 7 7CA77C1F 56 Bytes [ 50, 8D, 85, EC, FB, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFile + 2F 7CA77C58 43 Bytes [ 50, 56, 8D, 85, DC, F7, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFile + 5B 7CA77C84 17 Bytes [ B5, C8, F7, FF, FF, E8, 14, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFile + 6D 7CA77C96 18 Bytes [ 8D, 85, D4, F7, FF, FF, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFile + 80 7CA77CA9 52 Bytes [ 8B, 85, D4, F7, FF, FF, 3B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DragQueryFile + B5 7CA77CDE 9 Bytes [ 74, 31, FF, 75, 10, 8D, 85, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialogEx + 2D 7CA783C5 17 Bytes [ 7E, 11, FF, 75, 14, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialogEx + 3F 7CA783D7 44 Bytes [ FF, FF, 75, FC, FF, 15, 34, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialogEx + 6D 7CA78405 36 Bytes [ 90, 90, 90, 8B, FF, 55, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialogEx + 93 7CA7842B 11 Bytes [ 59, 89, 85, A4, FB, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialogEx + 9F 7CA78437 28 Bytes CALL 06A78437
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialog + 7 7CA78C8C 13 Bytes [ 75, 11, 53, C7, 05, 58, 59, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialog + 15 7CA78C9A 29 Bytes [ 15, 48, 14, 9C, 7C, 57, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialog + 33 7CA78CB8 21 Bytes [ 15, 08, 16, 9C, 7C, C3, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialog + 49 7CA78CCE 8 Bytes [ A1, 48, F5, BC, 7C, 89, 45, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RestartDialog + 52 7CA78CD7 22 Bytes [ 45, 08, 89, 85, 34, FD, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHOpenPropSheetW + A 7CA7964B 123 Bytes [ FF, 15, 78, 1D, 9C, 7C, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHOpenPropSheetW + 86 7CA796C7 18 Bytes [ 6A, 01, 68, 10, F0, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHOpenPropSheetW + 9B 7CA796DC 50 Bytes [ 8B, 75, 10, 83, E6, F0, 81, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHOpenPropSheetW + CE 7CA7970F 59 Bytes [ 35, A4, F5, BC, 7C, 89, 35, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHOpenPropSheetW + 10A 7CA7974B 74 Bytes [ 14, 56, FF, 75, 08, C7, 05, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CheckEscapesW + 85 7CA7B32D 9 Bytes [ 75, 10, 74, 11, 56, 68, 58, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CheckEscapesW + 8F 7CA7B337 8 Bytes [ 8D, 8D, 44, F9, FF, FF, 51, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CheckEscapesW + 98 7CA7B340 66 Bytes [ 50, 10, 53, FF, 15, 08, 16, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CheckEscapesA + 32 7CA7B383 30 Bytes [ FF, 15, 40, 1C, 9C, 7C, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CheckEscapesA + 51 7CA7B3A2 57 Bytes [ 55, 8B, EC, 51, 51, E8, 24, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CheckEscapesA + 8B 7CA7B3DC 100 Bytes [ 15, 04, 16, 9C, 7C, 8D, 45, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CheckEscapesA + F0 7CA7B441 92 Bytes [ 8D, B7, BC, 00, 00, 00, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrCpyNA + 17 7CA7B49E 89 Bytes [ D6, 85, C0, 5E, 74, 0F, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpW + 36 7CA7B4F9 27 Bytes [ F7, D8, 1B, C0, 23, 45, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpW + 52 7CA7B515 53 Bytes [ 65, FC, 00, 56, 8B, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpA + 2 7CA7B54B 105 Bytes CALL 7CB9E284 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpA + 6C 7CA7B5B5 4 Bytes [ 35, A4, F5, BC ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpA + 71 7CA7B5BA 163 Bytes [ FF, 15, 54, 1D, 9C, 7C, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpIA + 30 7CA7B65E 26 Bytes [ 85, C0, 0F, 85, 6E, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpIA + 4B 7CA7B679 26 Bytes [ FF, 36, FF, 15, 34, 16, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCmpIA + 66 7CA7B694 145 Bytes [ 55, 8B, EC, 81, EC, CC, 05, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrNCpyA + 35 7CA7B726 30 Bytes [ 50, 68, A4, 52, 9C, 7C, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrRStrW + 4 7CA7B745 54 Bytes [ 85, 4C, FA, FF, FF, 0F, B7, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrRStrW + 3B 7CA7B77C 360 Bytes [ FF, 50, 68, 53, 33, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetPathOffsetW + 75 7CA7B8E5 6 Bytes [ 00, 8D, 85, 50, FA, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirW + 2 7CA7B8EC 35 Bytes [ 50, 53, 68, 80, 01, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirW + 26 7CA7B910 15 Bytes [ 83, A5, 4C, FA, FF, FF, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirW + 36 7CA7B920 49 Bytes [ 00, 0F, 8E, 9A, 00, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirW + 68 7CA7B952 5 Bytes [ 00, E8, 1D, 32, F9 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirW + 6E 7CA7B958 30 Bytes [ 8B, 9D, 34, FA, FF, FF, 8B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirA + 29 7CA7B9B5 150 Bytes [ 3B, 86, B8, 00, 00, 00, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirW + 56 7CA7BA4C 84 Bytes [ 40, 5E, 5D, C2, 04, 00, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirW + AB 7CA7BAA1 5 Bytes [ 56, E8, C2, F9, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirW + B1 7CA7BAA7 34 Bytes [ EB, 53, 57, 8B, 7D, 14, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirW + D4 7CA7BACA 19 Bytes [ 15, 70, 1E, 9C, 7C, EB, 2B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirW + E8 7CA7BADE 11 Bytes [ 70, 0C, EB, E7, 8B, 4D, 14, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirA + A 7CA7BBE4 34 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirA + 2D 7CA7BC07 11 Bytes [ 00, 00, 04, 89, 45, FC, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirA + 39 7CA7BC13 45 Bytes [ C0, 0F, 85, CF, 00, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetCurDrive + E 7CA7BC41 82 Bytes [ BC, FE, FF, FF, 89, 85, C4, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheSetCurDrive + 3B 7CA7BC94 12 Bytes [ 15, B0, 1C, 9C, 7C, EB, 06, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheSetCurDrive + 48 7CA7BCA1 74 Bytes [ 80, 8D, B9, FE, FF, FF, 40, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathA + 42 7CA7BCEC 2 Bytes [ 07, 80 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathA + 45 7CA7BCEF 59 Bytes [ 4D, FC, 5F, 5E, 5B, E8, F7, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathA + 81 7CA7BD2B 43 Bytes [ C3, 90, 90, 90, 90, 90, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathA + AD 7CA7BD57 81 Bytes [ 00, 00, 48, C7, 85, A0, FD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathW + 4D 7CA7BDA9 38 Bytes [ 35, A4, F5, BC, 7C, FF, 15, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathW + 74 7CA7BDD0 32 Bytes [ 8B, D8, 85, DB, 74, 15, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathW + 95 7CA7BDF1 10 Bytes CALL 7C9EBAEC C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheFullPathW + A0 7CA7BDFC 114 Bytes [ 8B, 4D, FC, 5E, 5B, E8, EA, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirExW + 5B 7CA7BE6F 6 Bytes [ 90, 90, 90, 90, 90, 8B ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirExW + 62 7CA7BE76 48 Bytes [ 55, 8B, EC, 81, EC, 1C, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirExW + 93 7CA7BEA7 4 Bytes [ C7, 85, E8, FB ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirExW + 98 7CA7BEAC 23 Bytes [ FF, 02, 00, 00, 00, 50, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheGetDirExW + B0 7CA7BEC4 9 Bytes [ 68, 08, 02, 00, 00, 50, E8, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExW + 33 7CA7BF44 41 Bytes [ 8B, 4D, FC, 8B, 85, E8, FB, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExW + 5D 7CA7BF6E 21 Bytes [ 4D, 14, 53, 8B, 5D, 08, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExW + 73 7CA7BF84 52 Bytes [ FF, 89, 85, 40, F7, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExW + A8 7CA7BFB9 7 Bytes [ 00, 00, 8D, 85, 38, F7, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExW + B0 7CA7BFC1 55 Bytes [ 50, 8D, 85, 44, F7, FF, FF, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExA + 1F 7CA7C1B4 196 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExA + E5 7CA7C27A 17 Bytes [ 0C, 8B, 45, 08, 83, C0, 10, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExA + FA 7CA7C28F 25 Bytes [ 90, 8B, FF, 55, 8B, EC, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExA + 114 7CA7C2A9 36 Bytes [ FF, 55, 8B, EC, 56, 8B, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheChangeDirExA + 139 7CA7C2CE 59 Bytes CALL BDB436F6
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RegenerateUserEnvironment + 1B 7CA7D301 3 Bytes [ 85, F0, EF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RegenerateUserEnvironment + 20 7CA7D306 5 Bytes [ 50, 8D, 85, E8, EF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RegenerateUserEnvironment + 26 7CA7D30C 9 Bytes [ FF, 50, FF, 36, 66, 89, BD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RegenerateUserEnvironment + 30 7CA7D316 10 Bytes [ FF, 66, C7, 85, F2, EF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RegenerateUserEnvironment + 3B 7CA7D321 5 Bytes [ 15, 10, 17, 9C, 7C ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_CloseProperties + 11 7CA82AE5 1 Byte [ C0 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_CloseProperties + 13 7CA82AE7 77 Bytes [ 07, 66, 83, 4E, 02, FF, EB, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_CloseProperties + 61 7CA82B35 50 Bytes [ 50, 6A, 40, 8D, 85, 64, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_CloseProperties + 94 7CA82B68 71 Bytes [ 85, 54, FF, FF, FF, FF, 48, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_CloseProperties + DC 7CA82BB0 100 Bytes [ A8, FD, FF, FF, 8B, 45, 18, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_GetProperties + 18 7CA83208 11 Bytes CALL 7C9E83ED C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_GetProperties + 24 7CA83214 22 Bytes [ 90, 90, 90, 90, 90, E8, BB, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_GetProperties + 3B 7CA8322B 15 Bytes [ FF, 55, 8B, EC, 68, 00, 20, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_GetProperties + 4B 7CA8323B 71 Bytes CALL 7CA2BFF1 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_GetProperties + 93 7CA83283 78 Bytes [ 00, 74, 04, 33, C0, EB, 2C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_SetProperties + 43 7CA83AB2 46 Bytes [ 00, 75, 07, A1, 44, B1, BD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_SetProperties + 72 7CA83AE1 11 Bytes [ FF, 8B, F0, 85, F6, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_SetProperties + 7E 7CA83AED 10 Bytes [ 00, 00, 00, 8B, 4D, 0C, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_SetProperties + 8C 7CA83AFB 62 Bytes [ 40, 8B, 46, 10, A8, 01, 74, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_SetProperties + CB 7CA83B3A 22 Bytes [ 8B, 46, 40, 83, F8, FF, 74, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_OpenProperties + FB 7CA84068 31 Bytes [ DD, 9D, 7C, FF, 15, 2C, 14, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_OpenProperties + 11B 7CA84088 38 Bytes [ 15, 14, 1C, 9C, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_OpenProperties + 143 7CA840B0 34 Bytes [ C9, C3, 90, 90, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_OpenProperties + 166 7CA840D3 11 Bytes [ 51, 8D, 8D, EC, FB, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!PifMgr_OpenProperties + 172 7CA840DF 18 Bytes [ 00, 53, 33, FF, 89, 45, FC, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheRemoveQuotesW + 6 7CA8BF81 81 Bytes [ 4D, B8, 8B, 40, 04, C1, E9, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheRemoveQuotesA + 1C 7CA8BFD3 9 Bytes [ 75, B0, 89, 75, B4, FF, D3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheRemoveQuotesA + 26 7CA8BFDD 84 Bytes [ 21, 8B, 45, AC, 8B, 48, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheRemoveQuotesA + 7B 7CA8C032 96 Bytes [ 89, 48, 22, 8D, 45, B4, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathW + 25 7CA8C093 35 Bytes [ 75, B0, C7, 45, B4, 40, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathW + 49 7CA8C0B7 27 Bytes [ 83, 60, 02, 00, 6A, 04, 5E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathW + 65 7CA8C0D3 7 Bytes [ 75, B4, FF, D3, 85, C0, 75 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathW + 6D 7CA8C0DB 28 Bytes [ 8B, 45, AC, 8B, 40, 04, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathW + 8A 7CA8C0F8 143 Bytes [ B0, 89, 75, B4, FF, D3, 85, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathA + 3B 7CA8C25C 61 Bytes [ 75, B4, FF, D6, 83, 65, AC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathA + 79 7CA8C29A 135 Bytes [ 75, B4, FF, D6, 01, 5D, A8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathA + 101 7CA8C322 7 Bytes [ D6, 8B, 47, 04, 0F, B7, 48 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathA + 109 7CA8C32A 22 Bytes [ 0F, B7, 40, 10, 53, C1, E1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheShortenPathA + 120 7CA8C341 2 Bytes [ 75, B4 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheConvertPathW + 16 7CA8C5EC 17 Bytes [ 00, 80, 80, 80, 00, 8B, 42, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheConvertPathW + 28 7CA8C5FE 128 Bytes [ 8B, 42, 04, C7, 80, B4, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheConvertPathW + A9 7CA8C67F 9 Bytes [ EC, 20, FF, 75, 0C, 8D, 45, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheConvertPathW + B4 7CA8C68A 2 Bytes [ 14, 17 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SheConvertPathW + B9 7CA8C68F 61 Bytes [ 45, 08, 83, 65, F0, 00, 83, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLL 7CA8E029 3 Bytes [ 90, 90, 90 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLL + 4 7CA8E02D 28 Bytes [ FF, 55, 8B, EC, 56, 8B, F1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLL + 21 7CA8E04A 9 Bytes [ 74, 6C, 83, F8, FC, 74, 0E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLL + 2B 7CA8E054 20 Bytes [ 74, 37, 83, F8, FE, 0F, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLL + 40 7CA8E069 28 Bytes [ 15, 9C, 1A, 9C, 7C, 85, C0, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLLW + 2 7CA8E0E5 70 Bytes [ 15, E0, 1D, 9C, 7C, EB, 0E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLLW + 49 7CA8E12C 20 Bytes [ 76, 10, FF, 15, 68, 1D, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLLW + 5E 7CA8E141 93 Bytes [ BB, 09, 35, 00, 00, 74, 1C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLLW + BC 7CA8E19F 1 Byte [ 55 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!OpenAs_RunDLLW + BE 7CA8E1A1 46 Bytes [ EC, 83, EC, 30, 53, 56, 8B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Activate_RunDLL + 1B 7CA8F0AF 29 Bytes [ FF, 07, 00, 00, 00, E8, 21, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Activate_RunDLL + 39 7CA8F0CD 39 Bytes [ 15, 28, F2, BB, 7C, 8B, 4D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Activate_RunDLL + 61 7CA8F0F5 6 Bytes [ 5D, 08, 56, 8B, 75, 10 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Activate_RunDLL + 68 7CA8F0FC 2 Bytes [ 89, 45 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Activate_RunDLL + 6B 7CA8F0FF 10 Bytes CALL 7C9F07DE C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHIsFileAvailableOffline + 4E 7CA9217E 75 Bytes [ FF, 8B, 08, 50, FF, 51, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHIsFileAvailableOffline + 9A 7CA921CA 32 Bytes CALL 7C9EB8E6 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHIsFileAvailableOffline + BB 7CA921EB 26 Bytes [ FC, FF, FF, 6A, 00, 56, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHIsFileAvailableOffline + D6 7CA92206 16 Bytes CALL 7CA91E32 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHIsFileAvailableOffline + E7 7CA92217 147 Bytes [ 15, 34, 16, 9C, 7C, 33, C0, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEnumerateUnreadMailAccountsW + 2F 7CA92549 83 Bytes CALL 7CA92486 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEnumerateUnreadMailAccountsW + 83 7CA9259D 62 Bytes [ 00, 00, 00, B6, 63, A9, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEnumerateUnreadMailAccountsW + C3 7CA925DD 6 Bytes [ 75, 08, E8, A4, 06, F8 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEnumerateUnreadMailAccountsW + CA 7CA925E4 49 Bytes [ 8B, F0, 8B, 45, 08, 8B, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEnumerateUnreadMailAccountsW + FC 7CA92616 41 Bytes [ 75, 10, FF, 75, 0C, FF, 75, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetAttributesFromDataObject + C8 7CA92A59 63 Bytes [ 74, 0C, FF, B5, B0, FB, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetAttributesFromDataObject + 109 7CA92A9A 24 Bytes [ 18, FF, 75, 14, FF, 75, 10, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetAttributesFromDataObject + 122 7CA92AB3 23 Bytes [ 74, 07, 6A, 00, FF, 75, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetAttributesFromDataObject + 13A 7CA92ACB 52 Bytes [ 55, 8B, EC, 56, FF, 75, 1C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetAttributesFromDataObject + 16F 7CA92B00 61 Bytes [ 8B, D8, 0F, B7, 05, C0, F9, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteA + B4 7CA94AA0 17 Bytes CALL 7C9F9E2C C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteA + C8 7CA94AB4 40 Bytes [ 05, BF, 00, 00, 40, 00, 56, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteA + F1 7CA94ADD 11 Bytes [ 3B, C6, 8B, 5D, 10, 89, 03, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteA + FD 7CA94AE9 89 Bytes [ 00, 6A, 13, 56, 56, 56, 56, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPathPrepareForWriteA + 157 7CA94B43 49 Bytes [ FF, D6, 85, C0, 74, 4F, 68, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetUnreadMailCountW + 2 7CA94D0A 56 Bytes CALL 7CA2D8CA C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetUnreadMailCountW + 3B 7CA94D43 4 Bytes [ FF, BE, 00, 04 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetUnreadMailCountW + 41 7CA94D49 2 Bytes [ 0F, 84 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetUnreadMailCountW + 44 7CA94D4C 82 Bytes [ 01, 00, 00, 85, C0, 75, 03, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetUnreadMailCountW + 97 7CA94D9F 6 Bytes [ 45, BC, 50, 6A, 12, 56 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetUnreadMailCountW + 2C 7CA94F48 32 Bytes [ 8B, 0F, 80, E1, 01, F6, D9, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetUnreadMailCountW + 4D 7CA94F69 6 Bytes [ 68, 74, 96, 9C, 7C, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetUnreadMailCountW + 54 7CA94F70 53 Bytes [ D6, 8B, 07, 83, E0, 10, C1, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetUnreadMailCountW + 8B 7CA94FA7 93 Bytes [ FF, 75, FC, FF, D6, 8B, 07, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHSetUnreadMailCountW + E9 7CA95005 99 Bytes [ 75, FC, FF, D6, 8B, 07, 25, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetShellStyleHInstance + 1 7CA953A5 49 Bytes [ 85, F0, FD, FF, FF, 5F, 5E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetShellStyleHInstance + 33 7CA953D7 42 Bytes [ 8B, 45, 14, 53, 8B, 5D, 10, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetShellStyleHInstance + 5E 7CA95402 2 Bytes [ FF, 15 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetShellStyleHInstance + 61 7CA95405 15 Bytes [ 1C, 9C, 7C, 33, FF, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetShellStyleHInstance + 71 7CA95415 21 Bytes [ 85, EC, FD, FF, FF, 89, BD, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFormatDrive + 27 7CA982DC 2 Bytes [ 76, 30 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFormatDrive + 2A 7CA982DF 24 Bytes [ D7, 50, FF, D3, 6A, 01, 6A, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFormatDrive + 43 7CA982F8 23 Bytes [ 00, FF, 76, 30, FF, D7, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFormatDrive + 5B 7CA98310 20 Bytes [ 5E, 5B, 5D, C2, 04, 00, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFormatDrive + 70 7CA98325 3 Bytes [ 00, A1, 48 ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!AppCompat_RunDLLW + 2 7CA98A01 7 Bytes [ FF, 50, 53, 68, 43, 01, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!AppCompat_RunDLLW + A 7CA98A09 35 Bytes [ FF, B5, DC, FD, FF, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!AppCompat_RunDLLW + 2F 7CA98A2E 1 Byte [ FC ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!AppCompat_RunDLLW + 34 7CA98A33 11 Bytes [ 7C, 13, FF, B5, D4, FD, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!AppCompat_RunDLLW + 42 7CA98A41 7 Bytes CALL 7CA919D7 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CDefFolderMenu_Create2 + 37 7CA9A228 23 Bytes [ 55, 8B, EC, 51, 51, 53, 56, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CDefFolderMenu_Create2 + 4F 7CA9A240 5 Bytes [ 1D, 94, 1D, 9C, 7C ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CDefFolderMenu_Create2 + 55 7CA9A246 86 Bytes [ FF, D3, 8B, CE, 89, 45, F8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CDefFolderMenu_Create2 + AC 7CA9A29D 79 Bytes CALL 7CA92AC7 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CDefFolderMenu_Create2 + FC 7CA9A2ED 33 Bytes [ F0, 85, F6, 7C, 14, 8B, 45, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_AutoScroll + 17 7CAA54DD 29 Bytes [ 85, C0, 74, 14, 81, 78, 04, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_AutoScroll + 35 7CAA54FB 6 Bytes [ 90, 90, 90, 90, 90, 8B ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_AutoScroll + 3C 7CAA5502 30 Bytes [ 55, 8B, EC, 53, 56, 8B, 35, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_AutoScroll + 5B 7CAA5521 142 Bytes [ 00, 57, FF, D6, 53, 68, 2E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_AutoScroll + EA 7CAA55B0 66 Bytes [ 90, 90, 90, 90, 8B, FF, 55, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_DragEnterEx + 3 7CAAE9AB 122 Bytes [ F8, D1, F8, 03, D1, 3B, D3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_DragMove + 25 7CAAEA26 68 Bytes [ 03, 57, 57, 57, 57, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_SetDragImage + 2A 7CAAEA6B 52 Bytes [ 75, F8, FF, 75, 0C, FF, D3, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_SetDragImage + 5F 7CAAEAA0 24 Bytes CALL 7CA760A4 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_SetDragImage + 78 7CAAEAB9 11 Bytes [ 75, F4, FF, 15, 58, 12, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_SetDragImage + 84 7CAAEAC5 64 Bytes [ 15, 54, 12, 9C, 7C, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_DragLeave + 2A 7CAAEB06 21 Bytes [ 55, 8B, EC, 56, 57, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_DragLeave + 40 7CAAEB1C 13 Bytes CALL 7CAAE92A C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DAD_DragLeave + 4E 7CAAEB2A 146 Bytes [ FF, 75, 10, FF, 76, 50, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDoDragDrop + 80 7CAAEBBD 77 Bytes [ EB, 4B, 39, 44, BB, 58, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDoDragDrop + CE 7CAAEC0B 20 Bytes [ 44, BB, 58, 5F, 5B, 5D, C2, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDoDragDrop + E3 7CAAEC20 85 Bytes [ 14, 83, 65, EC, 00, 56, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDoDragDrop + 139 7CAAEC76 53 Bytes [ D6, 8B, C7, 5F, 5E, C9, C2, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDoDragDrop + 16F 7CAAECAC 10 Bytes [ 89, 5D, FC, 75, 6A, 57, E8, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllInstall + 46 7CAB1B72 48 Bytes [ 50, FF, D6, 83, C4, 10, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllInstall + 77 7CAB1BA3 13 Bytes [ 15, 10, 10, 9C, 7C, 8B, F8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllInstall + 86 7CAB1BB2 47 Bytes [ FF, FF, B5, B8, FE, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllInstall + B6 7CAB1BE2 27 Bytes [ 90, 90, 40, 00, 78, 00, 70, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!DllInstall + D2 7CAB1BFE 97 Bytes [ 2C, 00, 2D, 00, 25, 00, 64, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconA + 1D 7CAB4BF3 27 Bytes [ 00, 50, 8D, 46, 38, 50, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconA + 39 7CAB4C0F 28 Bytes [ 85, C0, 74, 07, 8B, CF, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconA + 56 7CAB4C2C 43 Bytes [ 5F, 83, 7D, 0C, 05, 75, 0B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconA + 82 7CAB4C58 18 Bytes CALL 7C9EB04B C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHDefExtractIconA + 95 7CAB4C6B 118 Bytes [ 75, 1A, FF, 75, 14, C7, 46, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHValidateUNC + 3C 7CAB51DC 6 Bytes [ FF, 74, 0D, 81, F9, 38 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHValidateUNC + 43 7CAB51E3 1 Byte [ FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHValidateUNC + 45 7CAB51E5 12 Bytes JMP 7CAB52E3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHValidateUNC + 52 7CAB51F2 21 Bytes [ 85, C0, 0F, 85, EB, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHValidateUNC + 69 7CAB5209 63 Bytes CALL 7CAB3974 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SignalFileOpen + C 7CAB595C 30 Bytes [ 55, 8B, EC, 81, EC, AC, 03, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SignalFileOpen + 2B 7CAB597B 74 Bytes [ 15, 5C, 1C, 9C, 7C, 8B, F0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SignalFileOpen + 76 7CAB59C6 3 Bytes [ 50, FC, 9D ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SignalFileOpen + 7A 7CAB59CA 37 Bytes [ 8D, 85, 5C, FC, FF, FF, 50, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SignalFileOpen + A0 7CAB59F0 11 Bytes [ 10, 9C, 7C, 89, 9D, 58, FC, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteExW + 75 7CAB5B56 10 Bytes CALL 7C9F3BB4 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteExW + 80 7CAB5B61 15 Bytes [ C0, 7C, 4F, 8D, 85, 54, FC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteExW + 90 7CAB5B71 11 Bytes [ 50, 6A, 00, 6A, 02, 6A, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteExW + 9C 7CAB5B7D 23 Bytes [ FF, 50, 53, FF, 15, 70, 1B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteA + B 7CAB5B95 11 Bytes [ 50, FF, 15, 28, 1C, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteA + 17 7CAB5BA1 17 Bytes [ B6, 4C, FB, 9D, 7C, 8D, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteA + 29 7CAB5BB3 11 Bytes [ 83, C6, 08, 83, FE, 50, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!RealShellExecuteW + 2 7CAB5BBF 145 Bytes CALL 7CA03717 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteW + 61 7CAB5C51 115 Bytes [ 90, 90, 90, 90, 90, 8B, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteW + D5 7CAB5CC5 205 Bytes [ 89, 45, 10, 75, 61, 6A, 20, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteW + 1A3 7CAB5D93 28 Bytes [ 75, 0C, FF, 15, 3C, 1C, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteW + 1C0 7CAB5DB0 26 Bytes [ A1, 48, F5, BC, 7C, 56, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExecuteW + 1DB 7CAB5DCB 18 Bytes CALL 7CA04965 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!GetFileNameFromBrowse + 18 7CAB72BB 5 Bytes [ 89, 9D, 0C, F1, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!GetFileNameFromBrowse + 1E 7CAB72C1 5 Bytes [ 89, B5, D8, F0, FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!GetFileNameFromBrowse + 24 7CAB72C7 86 Bytes [ 89, 9D, DC, F0, FF, FF, 89, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!GetFileNameFromBrowse + 7C 7CAB731F 26 Bytes [ 8B, 08, 50, FF, 51, 0C, 68, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!GetFileNameFromBrowse + 97 7CAB733A 22 Bytes [ 5A, 17, 00, 00, 50, FF, 35, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILAppendID + 12 7CAB7693 35 Bytes [ FF, FF, 15, 40, 19, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILAppendID + 37 7CAB76B8 100 Bytes [ 0F, 84, 78, 04, 00, 00, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILAppendID + 9C 7CAB771D 10 Bytes CALL 7CAB6E74 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILAppendID + A7 7CAB7728 91 Bytes [ FF, 50, 8D, 85, EC, FB, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILAppendID + 103 7CAB7784 4 Bytes [ 15, 54, 1D, 9C ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPathA + 2 7CAB78E2 29 Bytes [ FF, C7, 04, 07, 80, 75, 5F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPathA + 20 7CAB7900 3 Bytes [ B5, 58, F1 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPathA + 24 7CAB7904 24 Bytes [ FF, 01, 85, 4C, F1, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPathA + 3D 7CAB791D 12 Bytes [ 8B, 01, FF, B5, 4C, F1, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ILCreateFromPathA + 4A 7CAB792A 55 Bytes [ 85, 44, F1, FF, FF, 8B, 08, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathAndSubDirA + 6B 7CAB9A8F 26 Bytes [ 8B, 45, E4, 2B, 45, EC, 33, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathAndSubDirA + 86 7CAB9AAA 78 Bytes [ 08, 8B, 45, D8, 33, D2, 39, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathAndSubDirA + D5 7CAB9AF9 4 Bytes [ 00, FF, 76, 18 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathAndSubDirA + DA 7CAB9AFE 60 Bytes [ 15, 34, 1E, 9C, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetFolderPathAndSubDirA + 117 7CAB9B3B 27 Bytes [ D3, 8B, 3D, A4, 1D, 9C, 7C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHHandleUpdateImage + 2 7CABAD48 27 Bytes CALL 7CABAD48 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHHandleUpdateImage + 1E 7CABAD64 2 Bytes [ FF, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHHandleUpdateImage + 22 7CABAD68 2 Bytes [ 30, 16 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHHandleUpdateImage + 26 7CABAD6C 32 Bytes [ 8D, 44, 00, 02, 50, 8D, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHHandleUpdateImage + 47 7CABAD8D 35 Bytes [ B5, E4, FB, FF, FF, FF, 15, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifySuspendResume + 2 7CABB30F 61 Bytes CALL 7CABA7E1 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifySuspendResume + 40 7CABB34D 24 Bytes [ 39, 8D, 85, EC, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifySuspendResume + 59 7CABB366 12 Bytes [ B5, EC, FD, FF, FF, E8, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHChangeNotifySuspendResume + 66 7CABB373 164 Bytes [ 76, 08, FF, B5, F0, FD, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageW + 2A 7CABB418 19 Bytes [ 8D, 47, F0, 50, 6A, 00, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageW + 3E 7CABB42C 18 Bytes [ FF, 8D, 85, F4, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageW + 51 7CABB43F 14 Bytes [ 75, 10, 68, 7C, 01, 9E, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageW + 60 7CABB44E 63 Bytes [ 75, 10, FF, 77, F8, 53, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageW + A0 7CABB48E 28 Bytes [ 33, C0, 8B, 4D, FC, 5F, 5E, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageA + 3F 7CABB56C 112 Bytes [ 3D, 68, 1C, 9C, 7C, BE, 98, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageA + B0 7CABB5DD 110 Bytes [ 00, 00, FF, B5, EC, FD, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageA + 11F 7CABB64C 83 Bytes [ FF, 85, C0, 75, 13, FF, B5, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageA + 174 7CABB6A1 21 Bytes [ 00, 00, 83, C6, 1C, 83, BD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHUpdateImageA + 18A 7CABB6B7 2 Bytes [ 4D, FC ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListA + 2 7CAC23E2 18 Bytes [ 36, FF, 15, A4, F6, 9E, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListA + 16 7CAC23F6 85 Bytes [ EB, C4, C7, 45, FC, 0E, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListA + 6C 7CAC244C 148 Bytes [ 75, 08, FF, 75, FC, E8, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListA + 101 7CAC24E1 6 Bytes [ 00, 00, 8B, C3, 83, E8 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetDataFromIDListA + 108 7CAC24E8 62 Bytes [ 74, 08, 2B, C1, 0F, 85, 0F, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfo + 79 7CAC26D8 23 Bytes [ 51, 0C, 8B, D8, 3B, DE, 0F, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfo + 91 7CAC26F0 107 Bytes [ 75, 0C, FF, 15, 3C, 1A, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfo + FD 7CAC275C 6 Bytes JMP 7CAC2852 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfo + 104 7CAC2763 61 Bytes [ 34, 8D, 60, F0, A5, 7C, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetNewLinkInfo + 142 7CAC27A1 8 Bytes [ F9, 0A, 0F, 8C, A9, 00, 00, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHOpenFolderAndSelectItems + 7B 7CAC2A99 28 Bytes [ 7C, 0E, 8B, 4D, FC, F7, D9, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellItem 7CAC2AB6 7 Bytes [ 90, 90, 90, 90, 8B, FF, 55 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellItem + 8 7CAC2ABE 29 Bytes [ EC, 51, 83, 65, FC, 00, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellItem + 26 7CAC2ADC 2 Bytes [ 4D, FC ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellItem + 29 7CAC2ADF 44 Bytes [ D9, 1B, C9, 83, E1, FE, 41, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellItem + 56 7CAC2B0C 47 Bytes [ 75, 08, 6A, 77, 6A, 06, E8, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateFileExtractIconW + 9 7CAC2C2B 18 Bytes [ 59, 8B, 55, 14, 89, 0A, C9, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateFileExtractIconW + 1C 7CAC2C3E 74 Bytes [ EC, 51, 83, 65, FC, 00, 8D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateFileExtractIconW + 67 7CAC2C89 66 Bytes [ 75, 0C, FF, 75, 08, 6A, 02, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateFileExtractIconW + AA 7CAC2CCC 79 Bytes [ 75, 08, 6A, 02, 6A, 0A, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateFileExtractIconW + FA 7CAC2D1C 63 Bytes [ 4D, FC, F7, D9, 1B, C9, 83, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAppBarMessage + 87 7CAC3EE6 4 Bytes [ 8D, 85, 4C, FB ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAppBarMessage + 8C 7CAC3EEB 36 Bytes [ FF, 50, FF, 15, 78, 15, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAppBarMessage + B1 7CAC3F10 82 Bytes [ FF, 5F, 5E, 8B, 4D, FC, 5B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAppBarMessage + 104 7CAC3F63 42 Bytes [ FF, 89, B5, C4, F9, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHAppBarMessage + 12F 7CAC3F8E 31 Bytes [ 50, FF, 15, 4C, 1A, 9C, 7C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHEnableServiceObject + 2 7CAC3FD1 100 Bytes [ D6, 8D, 85, F4, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetInstanceExplorer + 30 7CAC4036 16 Bytes [ FF, 50, FF, 15, 14, 1B, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetInstanceExplorer + 41 7CAC4047 24 Bytes [ 0F, 84, 33, 01, 00, 00, 66, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetInstanceExplorer + 5A 7CAC4060 12 Bytes [ FF, 50, FF, B5, CC, F9, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetInstanceExplorer + 67 7CAC406D 50 Bytes [ FF, 50, FF, D3, FF, B5, D0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetInstanceExplorer + 9B 7CAC40A1 15 Bytes CALL 7CA0431E C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolderW + 17 7CAC6FB8 94 Bytes [ C1, C7, 00, D4, 67, 9D, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolderW + 76 7CAC7017 12 Bytes [ 50, 68, 00, 80, 00, 00, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolderW + 83 7CAC7024 78 Bytes [ B5, F0, FD, FF, FF, E8, 23, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolderW + D3 7CAC7074 4 Bytes [ 08, 50, FF, 51 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolderW + D8 7CAC7079 142 Bytes [ 8B, 4D, FC, 33, C0, 85, F6, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolder + 6D 7CAC7108 11 Bytes CALL 7C9FF573 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolder + 79 7CAC7114 18 Bytes [ 1D, 5C, 1D, 9C, 7C, 89, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolder + 8C 7CAC7127 12 Bytes [ 50, 68, 44, 37, 00, 00, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolder + 99 7CAC7134 25 Bytes [ 15, 6C, 1D, 9C, 7C, 83, 66, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHBrowseForFolder + B3 7CAC714E 143 Bytes [ 15, E0, 1D, 9C, 7C, FF, 37, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WOWShellExecute + 29 7CAC8601 66 Bytes [ 8B, F0, EB, 02, 33, F6, 3B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WOWShellExecute + 6C 7CAC8644 89 Bytes [ 8D, 55, EC, 52, 50, FF, 51, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WOWShellExecute + C7 7CAC869F 60 Bytes [ 68, 28, B2, 9D, 7C, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WOWShellExecute + 104 7CAC86DC 17 Bytes [ 75, 14, 6A, 00, 57, 50, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!WOWShellExecute + 116 7CAC86EE 51 Bytes [ 75, 05, BE, 05, 40, 00, 80, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExec_RunDLLW + 2 7CAC87D6 19 Bytes CALL 7CA9B2AD C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExec_RunDLLW + 16 7CAC87EA 28 Bytes [ EC, 56, 8D, 45, 08, 50, 6A, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExec_RunDLLW + 33 7CAC8807 9 Bytes [ 75, 10, 8B, 08, 6A, 01, 6A, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExec_RunDLLW + 3D 7CAC8811 10 Bytes [ 51, 20, 8B, F0, 8B, 45, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellExec_RunDLLW + 48 7CAC881C 26 Bytes [ 51, 08, 8B, C6, 5E, 5D, C2, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateProcessAsUserW + C 7CAC93A0 26 Bytes [ 19, 9C, 7C, F7, D8, 1B, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateProcessAsUserW + 28 7CAC93BC 18 Bytes [ 68, E0, 03, 00, 00, 6A, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateProcessAsUserW + 3B 7CAC93CF 71 Bytes [ 75, 08, FF, 15, EC, 1D, 9C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateProcessAsUserW + 83 7CAC9417 5 Bytes [ 15, 68, 1C, 9C, 7C ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateProcessAsUserW + 89 7CAC941D 16 Bytes [ F8, 3B, FE, 74, 4F, 66, 39, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHShellFolderView_Message + 2 7CACAA6E 5 Bytes [ FF, 04, 00, 00, 00 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHShellFolderView_Message + 8 7CACAA74 18 Bytes [ 15, 30, 1C, 9C, 7C, 85, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHShellFolderView_Message + 1B 7CACAA87 7 Bytes [ FF, 6A, 01, FF, B5, F4, F7 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHShellFolderView_Message + 23 7CACAA8F 84 Bytes CALL 7CA13719 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHShellFolderView_Message + 78 7CACAAE4 68 Bytes [ FF, 15, 00, 10, 9C, 7C, 5F, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderViewEx + 2 7CACAF07 1 Byte [ 50 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderViewEx + 4 7CACAF09 102 Bytes CALL 7C9EBEF9 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderViewEx + 6B 7CACAF70 35 Bytes [ 50, 8D, 85, FC, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderViewEx + 8F 7CACAF94 18 Bytes CALL 7CA136AD C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateShellFolderViewEx + A2 7CACAFA7 24 Bytes [ 50, FF, 35, A4, F5, BC, 7C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFind_InitMenuPopup + 55 7CACCCA3 32 Bytes [ 50, 30, 5F, 2B, D8, 5E, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFind_InitMenuPopup + 76 7CACCCC4 14 Bytes [ 08, 33, F6, 51, FF, 50, 64, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFind_InitMenuPopup + 86 7CACCCD4 30 Bytes CALL 7C9EC114 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFind_InitMenuPopup + A5 7CACCCF3 14 Bytes [ 8B, EC, 53, 56, 57, 6A, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFind_InitMenuPopup + B4 7CACCD02 16 Bytes [ 15, 70, 19, 9F, 7C, 85, C0, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFindFiles + 2 7CACE248 46 Bytes [ 75, 10, 83, C0, 0C, 50, E8, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFindFiles + 31 7CACE277 168 Bytes [ 55, 8B, EC, 51, 51, 83, 7D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFindFiles + DE 7CACE324 31 Bytes [ 8B, FF, 55, 8B, EC, 81, EC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFindFiles + FE 7CACE344 1 Byte [ FF ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHFindFiles + 100 7CACE346 23 Bytes [ 46, 10, 57, 8B, 7E, 0C, 8B, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHStartNetConnectionDialogW + 2 7CAD197F 48 Bytes [ 7C, 6B, 8B, 46, 14, 8B, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHStartNetConnectionDialogW + 33 7CAD19B0 94 Bytes [ B6, 34, 02, 00, 00, FF, 33, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHStartNetConnectionDialogW + 92 7CAD1A0F 10 Bytes [ C9, C2, 0C, 00, 90, 90, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHStartNetConnectionDialogW + 9D 7CAD1A1A 29 Bytes [ 55, 8B, EC, 81, EC, B8, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHStartNetConnectionDialogW + BB 7CAD1A38 125 Bytes [ FF, FF, 89, 45, FC, 8B, 43, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexW + 2A 7CAD3909 60 Bytes [ 55, 8B, EC, 8B, 4D, 08, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexW + 69 7CAD3948 76 Bytes [ 0D, 66, 83, 38, 00, 74, 07, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexW + B6 7CAD3995 24 Bytes [ 39, 5D, 14, 74, 0B, 6A, 02, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexW + CF 7CAD39AE 43 Bytes CALL 7C9EBDF3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexA + 23 7CAD39DA 54 Bytes [ 89, 1F, 89, 1E, B8, 05, 40, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexA + 5A 7CAD3A11 65 Bytes [ F0, 85, F6, 7C, 1A, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexA + 9C 7CAD3A53 96 Bytes [ 7D, 0C, 89, 45, FC, 8D, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexA + FD 7CAD3AB4 38 Bytes [ FF, 8B, 08, 50, FF, 51, 08, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHGetIconOverlayIndexA + 125 7CAD3ADC 106 Bytes [ 8B, 4D, 18, A1, 48, F5, BC, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgCreate + 14 7CAD4522 31 Bytes [ 08, FF, 75, FC, 50, FF, 51, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgCreate + 34 7CAD4542 102 Bytes [ FF, 55, 8B, EC, 8B, 45, 18, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgCreate + 9C 7CAD45AA 24 Bytes [ 00, A1, 48, F5, BC, 7C, 53, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgCreate + B5 7CAD45C3 12 Bytes [ FF, 05, 40, 00, 80, 33, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgCreate + C2 7CAD45D0 44 Bytes [ 55, 0C, 39, 11, 74, 0B, 40, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgWriteMultiple + 2 7CAD5170 53 Bytes [ FF, 50, FF, D6, 53, 8D, 85, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgWriteMultiple + 38 7CAD51A6 54 Bytes CALL 7CA25909 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgWriteMultiple + 6F 7CAD51DD 11 Bytes [ FF, 8D, 85, F4, FD, FF, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgWriteMultiple + 7B 7CAD51E9 38 Bytes CALL 7CA0C0B3 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHPropStgWriteMultiple + A2 7CAD5210 15 Bytes [ FF, FF, D6, 85, C0, 0F, 84, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLimitInputEdit + 3B 7CAD5E7D 27 Bytes [ 55, 8B, EC, 56, 57, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLimitInputEdit + 57 7CAD5E99 51 Bytes [ 85, C0, 74, 21, 33, F6, F6, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLimitInputEdit + 8B 7CAD5ECD 10 Bytes [ 55, 8B, EC, 56, 8B, 75, 14, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLimitInputEdit + 96 7CAD5ED8 43 Bytes [ 57, FF, 75, 10, BF, 05, 40, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLimitInputEdit + C2 7CAD5F04 31 Bytes [ EC, 56, 8B, 75, 14, 83, 26, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMultiFileProperties + B 7CAD62F3 30 Bytes [ 15, 30, 13, 9C, 7C, 33, C0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMultiFileProperties + 2A 7CAD6312 33 Bytes [ 8B, 46, 10, A9, 00, 00, 01, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMultiFileProperties + 4C 7CAD6334 14 Bytes [ F9, 30, 72, 06, 66, 83, F9, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMultiFileProperties + 5B 7CAD6343 112 Bytes [ 74, 0C, 66, 83, F9, 41, 72, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHMultiFileProperties + CC 7CAD63B4 10 Bytes [ 8B, F1, FF, 15, BC, 14, 9C, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 2E 7CAD6ABD 1 Byte [ 55 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 30 7CAD6ABF 2 Bytes [ EC, 56 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 33 7CAD6AC2 94 Bytes [ 8B, 7D, 08, 57, 8B, F1, FF, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 92 7CAD6B21 174 Bytes [ 75, 09, 09, 46, 10, 83, 4E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 141 7CAD6BD0 149 Bytes [ 00, FF, FF, 75, 0F, 83, 7E, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExeDlgProc + 10 7CAF5D63 49 Bytes [ 14, 8B, F8, 85, FF, 7C, 11, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExeDlgProc + 42 7CAF5D95 4 Bytes [ EC, 51, 53, 57 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExeDlgProc + 47 7CAF5D9A 76 Bytes [ 7D, 08, 8D, 4F, DC, E8, FE, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExeDlgProc + 94 7CAF5DE7 21 Bytes [ 11, 8B, 35, D4, 19, 9C, 7C, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!FindExeDlgProc + AA 7CAF5DFD 19 Bytes [ D6, 85, C0, 7C, 06, 8B, 45, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CallCPLEntry16 + 16 7CB26310 2 Bytes [ 45, 18 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CallCPLEntry16 + 19 7CB26313 111 Bytes [ 08, 6A, FF, 50, FF, 91, A4, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CallCPLEntry16 + 89 7CB26383 9 Bytes [ 15, F4, 1F, 9C, 7C, 39, 5D, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CallCPLEntry16 + 93 7CB2638D 36 Bytes CALL 7CB26916 C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!CallCPLEntry16 + B8 7CB263B2 39 Bytes [ 45, FC, 8B, C1, 6A, 08, 8D, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Options_RunDLL + 8 7CB5C586 302 Bytes [ FF, AB, AB, AB, 8D, 85, D0, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Options_RunDLLW + 10B 7CB5C6B5 2 Bytes [ 0F, D8 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Options_RunDLLW + 10F 7CB5C6B9 30 Bytes [ 8B, F0, 85, F6, 75, 31, 57, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Options_RunDLLW + 12E 7CB5C6D8 2 Bytes CALL E6B5C6E0
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Options_RunDLLW + 132 7CB5C6DC 62 Bytes [ 6A, 0A, 56, FF, 15, 18, 1E, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!Options_RunDLLW + 171 7CB5C71B 64 Bytes [ 75, D8, FF, 75, 08, FF, 15, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateLocalServerRunDll + 1 7CB5E4F6 374 Bytes [ C6, 5E, C9, C2, 08, 00, 90, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateLocalServerRunDll + 178 7CB5E66D 39 Bytes [ 90, 90, 90, 90, 8B, FF, 55, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateLocalServerRunDll + 1A0 7CB5E695 59 Bytes [ FF, 85, C0, 8B, 75, 1C, 74, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateLocalServerRunDll + 1DC 7CB5E6D1 8 Bytes [ 83, 65, 08, 00, F6, 06, 03, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!SHCreateLocalServerRunDll + 1E5 7CB5E6DA 88 Bytes [ 5B, 66, 89, 45, D4, 89, 5D, … ]
.text …
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!ShellMessageBoxW + 1 7CB9C972 10 Bytes [ 75, FC, 68, 31, 04, 00, 00, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrChrA + 1 7CB9C97D 10 Bytes [ D6, 50, FF, 75, FC, 68, 30, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrChrIA + 1 7CB9C988 32 Bytes [ 77, 08, FF, D6, 53, FF, 75, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrCmpNA + 1 7CB9C9A9 10 Bytes [ 45, FC, 8B, 45, FC, 3B, 45, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrCmpNIA + 1 7CB9C9B4 25 Bytes [ 77, 08, 8D, 4F, 48, E8, 83, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrCmpNW + 6 7CB9C9CF 5 Bytes [ 50, 50, FF, 77, 08 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrRChrA + 1 7CB9C9D5 4 Bytes [ 15, A8, F4, BB ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrRChrA + 6 7CB9C9DA 47 Bytes [ FF, 75, 08, 8B, CF, E8, 19, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrRStrIW 7CB9CA0B 61 Bytes [ 90, 90, 90, 8B, FF, 55, 8B, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + 1F 7CB9CA4B 52 Bytes [ 8B, FF, 55, 8B, EC, 83, EC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + 56 7CB9CA82 57 Bytes [ 8B, FF, 55, 8B, EC, 81, EC, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + 90 7CB9CABC 4 Bytes [ 76, 50, FF, 15 ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + 95 7CB9CAC1 27 Bytes [ 1D, 9C, 7C, 39, BD, DC, FD, … ]
.text C:\WINDOWS\system32\winlogon.exe[220] SHELL32.dll!StrStrW + B1 7CB9CADD 21 Bytes CALL 7CB819DE C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text …

—- Devices - GMER 1.0.14 —-

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

—- Disk sectors - GMER 1.0.14 —-

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

—- EOF - GMER 1.0.14 —-

jpshortstuff

Post #6January 18, 2009, 2:37 PM UTC

Hi

I am just consulting some colleagues about your GMER log. A repair install may an option, I will advise you on possible courses of action once I have this log checked out. Thanks for your patience.

jpshortstuff

Post #7January 19, 2009, 7:20 AM UTC

Hi

Nothing bad there. Please run HijackThis again, do a system scan and post the logfile in a new reply here. Thanks.

jpshortstuff

Post #8January 24, 2009, 6:16 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

[Closed] logging into laptop and running problems

✨ Ask AI

Ask AI