RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>SSDT State
==============================================
==============================================
>Shadow
==============================================
==============================================
>Processes
==============================================
0x823C8830 [4] System
0x81661DA0 [168] C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation, igfxsrvc Module)
0x817C5CB8 [172] C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc., AutoUpater Service Module)
0x817CB830 [208] C:\WINDOWS\explorer.exe (Microsoft Corporation, Windows Explorer)
0x816618A8 [344] C:\Program Files\Battery Meter\BTMeter.exe (Dell, -)
0x81660DA0 [364] C:\Program Files\Wireless Select Switch\WLSS.exe (Dell, Wlss)
0x81729508 [508] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard, hpwuSchd Application)
0x81949DA0 [768] C:\WINDOWS\system32\smss.exe (Microsoft Corporation, Windows NT Session Manager)
0x81941020 [820] C:\WINDOWS\system32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x818F3A20 [844] C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation, Windows NT Logon Application)
0x81901020 [888] C:\WINDOWS\system32\services.exe (Microsoft Corporation, Services and Controller app)
0x818D4820 [900] C:\WINDOWS\system32\lsass.exe (Microsoft Corporation, LSA Shell (Export Version))
0x818A2A58 [1064] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x81896020 [1128] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x81883520 [1184] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x81873880 [1320] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x818672E0 [1380] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8171F858 [1500] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation, CTF Loader)
0x81844988 [1644] C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App)
0x81839DA0 [1716] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x81830BE0 [1772] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x81829020 [1784] C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc., Java(TM) Quick Starter Service)
0x8166CBE0 [1824] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc., Synaptics TouchPad Enhancements)
0x81673C08 [1856] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp., Realtek HD Audio Control Panel)
0x8166B478 [1944] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation, hkcmd Module)
0x817DA968 [1988] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8166A2E0 [2008] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation, persistence Module)
0x81672020 [2012] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc., Java(TM) Platform SE binary)
0x817869C8 [2320] C:\Documents and Settings\Miki\Desktop\RkU3.8.388.590\MustBeRandomlyNamed\Grvxbm8urSknN6pn.exe (UG North, RKULE, SR2 Normandy)
0x822FB2B8 [2428] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x81656DA0 [2940] C:\WINDOWS\system32\alg.exe (Microsoft Corporation, Application Layer Gateway Service)
0x8163F920 [3384] C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co., HP CUE Status Root)
0x818C4B10 [3432] C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (Hewlett-Packard Co., HP CUE Alert Popup Window Objects)
0x8163EDA0 [3480] C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (Hewlett-Packard, GPCore COM object)
0x8160D9A0 [3688] C:\Program Files\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc., Java(TM) Update Checker)
==============================================
>Drivers
==============================================
0xF7B76000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5857280 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xAA310000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4915200 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0xBF1E7000 C:\WINDOWS\System32\igxpdx32.DLL 2699264 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2150400 bytes
0x804D7000 RAW 2150400 bytes
0x804D7000 WMIxWDM 2150400 bytes
0xBF800000 Win32k 1863680 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1863680 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF04F000 C:\WINDOWS\System32\igxpdv32.DLL 1671168 bytes (Intel Corporation, Component GHAL Driver)
0xF79D0000 C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 1290240 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver)
0xF8227000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xF810C000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 503808 bytes (Microsoft Corporation, WDF Dynamic)
0xAA03D000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF7889000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xAA210000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA9B41000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA9343000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF795A000 C:\WINDOWS\system32\DRIVERS\SynTP.sys 229376 bytes (Synaptics, Inc., Synaptics Touchpad Driver)
0xF8345000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA9C88000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF81FA000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xBF024000 C:\WINDOWS\System32\igxpgd32.dll 176128 bytes (Intel Corporation, Intel Graphics 2D Driver)
0xA8F2A000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xAA0AD000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF7B3A000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xAA1C0000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xAA19A000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xAA2EC000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF7992000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF78E7000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xAA178000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806E4000 ACPI_HAL 134528 bytes
0x806E4000 C:\WINDOWS\system32\hal.dll 134528 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF82DD000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF8315000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF81E0000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF79B6000 C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 106496 bytes (Realtek Semiconductor Corporation , Realtek 10/100/1000 NDIS 5.1 Driver )
0xF82FD000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xAA025000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF7B0B000 C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xF7B23000 C:\WINDOWS\system32\DRIVERS\jmcr.sys 94208 bytes (JMicron Technology Corp., JMicron JMB38X Memory Card Reader Driver)
0xF82B4000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF7943000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA9B2C000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF7B62000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xAA269000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xBF012000 C:\WINDOWS\System32\igxprd32.dll 73728 bytes (Intel Corporation, Intel Graphics 2D Rotation Driver)
0xF82CB000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF8334000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF790A000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF85A4000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF86D4000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF8594000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF8474000 gera.sys 57344 bytes
0xF84C4000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF8514000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF8524000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF84A4000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF8504000 C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0xF8544000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF8604000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF8494000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF8534000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF8484000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF8574000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF8564000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF84B4000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF84F4000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF8554000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF85D4000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA946C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF85C4000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF884C000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF875C000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF8824000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF86F4000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF876C000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF877C000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF874C000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF882C000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF883C000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF86FC000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF87AC000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF87BC000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF879C000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF887C000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF888C000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver)
0xF8938000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0xF8958000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA9F19000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF8890000 ACPIEC.sys 12288 bytes (Microsoft Corporation, ACPI Embedded Controller Driver)
0xF8884000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF8888000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0xAA2AC000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF8924000 C:\WINDOWS\system32\DRIVERS\EMSC.SYS 12288 bytes
0xF792F000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xF8940000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF791F000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF8990000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF899E000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF898C000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF8974000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF8994000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF8998000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF8982000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF897C000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF8976000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF8B1B000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF8A95000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF8B63000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF8A3D000 C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 4096 bytes (Microsoft Corporation, ACPI Operation Registration Driver)
0xF8A3C000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
==============================================
>Files
==============================================
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x0006ECAE, Type: Inline - RelativeJump 0x80545CAE-->80545CB5 [ntkrnlpa.exe]
[1500]ctfmon.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[1500]ctfmon.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[168]igfxsrvc.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[1824]SynTPEnh.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[1856]RTHDCPL.EXE-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]

[1944]hkcmd.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[1944]hkcmd.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[2008]igfxpers.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[2012]jusched.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[2012]jusched.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[2012]jusched.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[2012]jusched.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[2012]jusched.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[2012]jusched.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[2012]jusched.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[2012]jusched.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[208]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[208]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[208]explorer.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[208]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]
[208]explorer.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->00000000 [shimeng.dll]
[208]explorer.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[208]explorer.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[208]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[208]explorer.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[208]explorer.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[208]explorer.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[208]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [shimeng.dll]
[208]explorer.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[208]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[208]explorer.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[208]explorer.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[3384]hpqste08.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]

[3432]hpqbam08.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[3432]hpqbam08.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[344]BTMeter.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[344]BTMeter.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[344]BTMeter.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[344]BTMeter.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[344]BTMeter.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[344]BTMeter.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[344]BTMeter.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[344]BTMeter.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[3480]hpqgpc01.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[364]WLSS.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[364]WLSS.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[364]WLSS.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[364]WLSS.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[364]WLSS.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[364]WLSS.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[364]WLSS.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[364]WLSS.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[3688]jucheck.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[3688]jucheck.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[3688]jucheck.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[3688]jucheck.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[3688]jucheck.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[3688]jucheck.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[3688]jucheck.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[3688]jucheck.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->kernel32.dll-->GetFileAttributesExW, Type: Inline - RelativeJump 0x7C811195-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->ntdll.dll-->NtCreateThread, Type: Inline - RelativeJump 0x7C90D1AE-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->BeginPaint, Type: Inline - RelativeJump 0x7E428FE9-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->CallWindowProcA, Type: Inline - RelativeJump 0x7E42A97D-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->CallWindowProcW, Type: Inline - RelativeJump 0x7E42A01E-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefDlgProcA, Type: Inline - RelativeJump 0x7E43E577-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefDlgProcW, Type: Inline - RelativeJump 0x7E423D3A-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefFrameProcA, Type: Inline - RelativeJump 0x7E44F965-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefFrameProcW, Type: Inline - RelativeJump 0x7E430833-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefMDIChildProcA, Type: Inline - RelativeJump 0x7E44F9B4-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefMDIChildProcW, Type: Inline - RelativeJump 0x7E430A47-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefWindowProcA, Type: Inline - RelativeJump 0x7E42C17E-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->DefWindowProcW, Type: Inline - RelativeJump 0x7E428D20-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->EndPaint, Type: Inline - RelativeJump 0x7E428FFD-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetCapture, Type: Inline - RelativeJump 0x7E4194DA-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetClipboardData, Type: Inline - RelativeJump 0x7E430DBA-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetDC, Type: Inline - RelativeJump 0x7E4186C7-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetDCEx, Type: Inline - RelativeJump 0x7E42C595-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetMessageA, Type: Inline - RelativeJump 0x7E42772B-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetMessagePos, Type: Inline - RelativeJump 0x7E42996C-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetMessageW, Type: Inline - RelativeJump 0x7E4191C6-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetUpdateRect, Type: Inline - RelativeJump 0x7E42A8C9-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetUpdateRgn, Type: Inline - RelativeJump 0x7E42F5EC-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->GetWindowDC, Type: Inline - RelativeJump 0x7E419021-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->MonitorFromPoint, Type: Inline - RelativeJump 0x7E42ABF5-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->MonitorFromRect, Type: Inline - RelativeJump 0x7E42C713-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->MonitorFromWindow, Type: Inline - RelativeJump 0x7E42A679-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->OpenInputDesktop, Type: Inline - RelativeJump 0x7E41ECA3-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->PeekMessageA, Type: Inline - RelativeJump 0x7E42A340-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump 0x7E41929B-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->RegisterClassA, Type: Inline - RelativeJump 0x7E42EA5E-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->RegisterClassExA, Type: Inline - RelativeJump 0x7E427C39-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->RegisterClassExW, Type: Inline - RelativeJump 0x7E41AF7F-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->RegisterClassW, Type: Inline - RelativeJump 0x7E41A39A-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->ReleaseCapture, Type: Inline - RelativeJump 0x7E42C37A-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->ReleaseDC, Type: Inline - RelativeJump 0x7E41869D-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->SetCapture, Type: Inline - RelativeJump 0x7E42C35E-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump 0x7E4561B3-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->SwitchDesktop, Type: Inline - RelativeJump 0x7E41FE6E-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->user32.dll-->TranslateMessage, Type: Inline - RelativeJump 0x7E418BF6-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->HttpQueryInfoA, Type: Inline - RelativeJump 0x3D94878D-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump 0x3D95EE89-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->HttpSendRequestExA, Type: Inline - RelativeJump 0x3D9BA70A-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->HttpSendRequestExW, Type: Inline - RelativeJump 0x3D9BA763-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->HttpSendRequestW, Type: Inline - RelativeJump 0x3D94FABE-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump 0x3D949088-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->InternetQueryDataAvailable, Type: Inline - RelativeJump 0x3D94BF7F-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump 0x3D94654B-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->wininet.dll-->InternetReadFileExA, Type: Inline - RelativeJump 0x3D963381-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump 0x71AB3E2B-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump 0x71AB4C27-->00000000 [unknown_code_page]
[508]hpwuSchd2.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump 0x71AB68FA-->00000000 [unknown_code_page]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

Hmm I did not want to resort to this.

Please download DrWeb-CureIt and save it to your Desktop. Do NOT perform a scan yet

• Double-click on drweb-cureit.exe to start the program.
  An Express Scan of your PC notice will appear.
  
• Under Start the Express Scan Now, Click OK to start the scan.
  This is a short scan that will scan the files currently running in memory.
  If something is found, click the Yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click Options > Change settings
  
• Choose the Scan tab and UNcheck Heuristic analysis
  
• Back at the main window, click Custom Scan, then Select drives (a red dot will show which drives have been chosen).
  
• Then click the Start/Stop Scanning button (green arrow on the right, and the scan will start.
  
• When finished, a message will be displayed at the bottom advising if any viruses were found.
  
• Click Yes to all if it asks if you want to cure/move the file.
  
• When the scan has finished, look if you can see the icon next to the files found.
  If so, click it, then click the next icon right below and select Move incurable.
  (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  
• Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit when you have finished.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
  

this was the only thing in the log:


rexiy.exe;c:\documents and settings\miki\application data\ytki;Trojan.PWS.Panda.354;Deleted.

Are the redirects continuing?

yep, they are still redirecting. not even letting up a little.

Download and run SVCHOST Diag.

Post the log from it when it launches.

this computer also got another attack from scareware. its the 3 time in a week that it keeps comming up. here is the log:



SVCHOST Diag



~~~~~Services loaded under SVCHOST~~~~~



~~~~~Modules loaded under SVCHOST~~~~~



~~~~~SVCHOST service~~~~~

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"HTTPFilter"=hex(7):48,00,54,00,54,00,50,00,46,00,69,00,6c,00,74,00,65,00,72,\
00,00,00,00,00
"LocalService"=hex(7):41,00,6c,00,65,00,72,00,74,00,65,00,72,00,00,00,57,00,65,\
00,62,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4c,00,6d,00,48,00,6f,00,\
73,00,74,00,73,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,52,00,65,00,67,\
00,69,00,73,00,74,00,72,00,79,00,00,00,75,00,70,00,6e,00,70,00,68,00,6f,00,\
73,00,74,00,00,00,53,00,53,00,44,00,50,00,53,00,52,00,56,00,00,00,00,00
"NetworkService"=hex(7):44,00,6e,00,73,00,43,00,61,00,63,00,68,00,65,00,00,00,\
00,00
"netsvcs"=hex(7):36,00,74,00,6f,00,34,00,00,00,41,00,70,00,70,00,4d,00,67,00,\
6d,00,74,00,00,00,41,00,75,00,64,00,69,00,6f,00,53,00,72,00,76,00,00,00,42,\
00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,43,00,72,00,79,00,70,00,74,00,\
53,00,76,00,63,00,00,00,44,00,4d,00,53,00,65,00,72,00,76,00,65,00,72,00,00,\
00,44,00,48,00,43,00,50,00,00,00,45,00,52,00,53,00,76,00,63,00,00,00,45,00,\
76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,46,00,61,\
00,73,00,74,00,55,00,73,00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,\
69,00,6e,00,67,00,43,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,\
00,69,00,74,00,79,00,00,00,48,00,69,00,64,00,53,00,65,00,72,00,76,00,00,00,\
49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,00,49,00,72,00,6d,\
00,6f,00,6e,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,\
76,00,65,00,72,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,57,00,6f,00,72,\
00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,4d,00,65,00,73,00,\
73,00,65,00,6e,00,67,00,65,00,72,00,00,00,4e,00,65,00,74,00,6d,00,61,00,6e,\
00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,\
00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,\
00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,\
74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,\
00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,\
63,00,65,00,73,00,73,00,00,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,\
00,00,00,53,00,65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,53,00,45,00,\
4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,\
00,73,00,73,00,00,00,53,00,52,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
00,00,54,00,61,00,70,00,69,00,73,00,72,00,76,00,00,00,54,00,68,00,65,00,6d,\
00,65,00,73,00,00,00,54,00,72,00,6b,00,57,00,6b,00,73,00,00,00,57,00,33,00,\
32,00,54,00,69,00,6d,00,65,00,00,00,57,00,5a,00,43,00,53,00,56,00,43,00,00,\
00,57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,\
00,00,77,00,69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,77,00,73,00,63,00,73,\
00,76,00,63,00,00,00,78,00,6d,00,6c,00,70,00,72,00,6f,00,76,00,00,00,6e,00,\
61,00,70,00,61,00,67,00,65,00,6e,00,74,00,00,00,68,00,6b,00,6d,00,73,00,76,\
00,63,00,00,00,42,00,49,00,54,00,53,00,00,00,77,00,75,00,61,00,75,00,73,00,\
65,00,72,00,76,00,00,00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,44,00,65,\
00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,00,00,00,68,00,65,00,6c,00,70,00,\
73,00,76,00,63,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,00,00,\
00,00,00
"DcomLaunch"=hex(7):44,00,63,00,6f,00,6d,00,4c,00,61,00,75,00,6e,00,63,00,68,\
00,00,00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
00,00,00,00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"eapsvcs"=hex(7):65,00,61,00,70,00,68,00,6f,00,73,00,74,00,00,00,00,00
"dot3svc"=hex(7):64,00,6f,00,74,00,33,00,73,00,76,00,63,00,00,00,00,00
"imgsvc"=hex(7):53,00,74,00,69,00,53,00,76,00,63,00,00,00,00,00
"termsvcs"=hex(7):54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,\
65,00,00,00,00,00
"WINRM"=hex(7):57,00,49,00,4e,00,52,00,4d,00,00,00,00,00
"HPZ12"=hex(7):50,00,6d,00,6c,00,20,00,44,00,72,00,69,00,76,00,65,00,72,00,20,\
00,48,00,50,00,5a,00,31,00,32,00,00,00,4e,00,65,00,74,00,20,00,44,00,72,00,\
69,00,76,00,65,00,72,00,20,00,48,00,50,00,5a,00,31,00,32,00,00,00,00,00
"hpdevmgmt"=hex(7):68,00,70,00,71,00,63,00,78,00,73,00,30,00,38,00,00,00,68,00,\
70,00,71,00,64,00,64,00,73,00,76,00,63,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\DComLaunch]
"CoInitializeSecurityParam"=dword:00000001
"DefaultRpcStackSize"=dword:00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\dot3svc]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\eapsvcs]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\HTTPFilter]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00002000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00003020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\PCHealth]
"CoInitializeSecurityParam"=dword:00000002
"AuthenticationCapabilities"=dword:00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
"CoInitializeSecurityParam"=dword:00000001
"DefaultRpcStackSize"=dword:00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\WINRM]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00003020



~~~~~SVCHOST MD5~~~~~

27C6D03BCDB8CFEB96B716F3D8BE3E18 C:\WINDOWS\system32\svchost.exe


~~~~~END OF FILE!~~~~~

I see it is going to hide again.

Please download Stealth MBR Rootkit Detector by GMER from GMER.net, and save to your Desktop.

• Double-click mbr.exe to start the program.
  
• When done scanning, it will save a log on the Desktop called mbr.log.
  
• Please post the contents of that log in your next reply.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

Running from: C:\Documents and Settings\Miki\Desktop\Win32kDiag.exe

Log file at : C:\Documents and Settings\Miki\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!

Download Kernel Detective: http://www.kernelmode.info/ARKs/Kernel_Detective_v1.3.1.zip

Extract the file to your Desktop.

Enter the folder and double-click on Kernel Detective.exe to get started.

We need four different logs, to be uploaded.

Click on Kernel Modifications tab, then click on File > Save Current List, and give it a name. The name should be in *.txt format.

Save the log to your Desktop.

Do the same for the Drivers tab, System Service Descriptor Table, and the System Service Descriptor Table Shadow.

Attach all the logs to your next reply.

here is the modification log:




Kernel Detective v1.3.1
http://www.at4re.com
===============================================
2010-7-16 22:50:7
===============================================
Current NT Build Number = 2600
===============================================

Address: 0x8054173A
Location: ntkrnlpa.exe [.text]
Len: 1
State: Code Modification
Current Value: 06
Original Value: 05
Destination Module: -


Address: 0x80545CAE
Location: ntkrnlpa.exe [.text]
Len: 18
State: Code Modification
Current Value: E0 25 7F FF FF FF 0F 22 E0 0D 80 00 00 00 0F 22 E0 C3
Original Value: D8 0F 22 D8 C3 0F 20 E0 25 7F FF FF FF 0F 22 E0 0D 80
Destination Module: -


Address: 0x80545CC6
Location: ntkrnlpa.exe [.text]
Len: 1
State: Code Modification
Current Value: 00
Original Value: C3
Destination Module: -


Address: 0x805466B4
Location: ntkrnlpa.exe [.text]::RtlPrefetchMemoryNonTemporal
Len: 1
State: Code Modification
Current Value: 90
Original Value: C3
Destination Module: -