GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-12-23 17:31:01 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 ST31000340AS rev.SD1A 931,51GB Running: 3qcp5coc.exe; Driver: C:\Users\user\AppData\Local\Temp\aftcaaob.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[1844] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\ApplicationHosting\ApplicationHosting.exe[1900] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\NetService\netservice.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 000000006ec717fa 2 bytes CALL 76cc11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 000000006ec71860 2 bytes CALL 76cc11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 000000006ec71942 2 bytes JMP 76927089 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 000000006ec7194d 2 bytes JMP 7692cba6 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2140] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[2188] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Solotough\Solotough.exe[3352] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5084] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757a1401 2 bytes JMP 76ceb20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757a1419 2 bytes JMP 76ceb336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757a1431 2 bytes JMP 76d68f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757a144a 2 bytes CALL 76cc4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757a14dd 2 bytes JMP 76d68832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757a14f5 2 bytes JMP 76d68a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757a150d 2 bytes JMP 76d68728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757a1525 2 bytes JMP 76d68af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757a153d 2 bytes JMP 76cdfc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757a1555 2 bytes JMP 76ce68df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757a156d 2 bytes JMP 76d68ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757a1585 2 bytes JMP 76d68b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757a159d 2 bytes JMP 76d686ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757a15b5 2 bytes JMP 76cdfd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757a15cd 2 bytes JMP 76ceb2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757a16b2 2 bytes JMP 76d68eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4352] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757a16bd 2 bytes JMP 76d68681 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Program Files\Internet Explorer\iexplore.exe[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW] [7fee99f67d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW] [7fee99d0740] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA] [7fee99f6140] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW] [7fee99f67d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW] [7fee99f67d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW] [7fee99d0740] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW] [7fee99f67d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!DialogBoxIndirectParamW] [7fee99f6060] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW] [7fee99f6060] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW] [7fee99f67d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW] [7fee99f6ec0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\netprofm.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\explorerframe.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\explorerframe.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\DUI70.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW] [7fee99f67d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\NaturalLanguage6.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\tquery.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\StructuredQuery.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\Wpc.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\wevtapi.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\ntshrui.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\ntshrui.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\ieapfltr.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\EhStorShell.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\cscui.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\cscui.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\cscui.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\CSCDLL.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\actxprxy.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\thumbcache.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SHDOCVW.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SHDOCVW.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SHDOCVW.dll[USER32.dll!DialogBoxParamW] [7fee99f6240] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\SearchFolder.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\NetworkExplorer.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\WINSTA.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\System32\DAVHLPR.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\WINMM.dll[USER32.dll!MessageBoxW] [7fee99f67d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\PortableDeviceApi.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\PortableDeviceTypes.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\IconCodecService.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\EhStorAPI.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\twext.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Windows\system32\twext.dll[USER32.dll!EnableWindow] [7fee99beee0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[332] @ C:\Program Files\Windows Defender\MpOav.dll[KERNEL32.dll!GetProcAddress] [7fee99b1c40] C:\Program Files\Internet Explorer\IEShims.dll ---- Processes - GMER 2.1 ---- Library C:\Users\user\AppData\Local\Builder Camera\{E8745889-AF02-0D47-5BDC-46CBACCEF8A2}\ywf.dll (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [1836](2015-12-19 18:05:21) 0000000071300000 Library C:\Users\user\AppData\Local\Builder Camera\{E8745889-AF02-0D47-5BDC-46CBACCEF8A2}\{CF2F02E9-3345-9366-EC14-248D199CC135}.dat (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [1836](2015-12-19 18:05:20) 00000000003e0000 Library C:\Users\user\AppData\Local\Builder Camera\{E8745889-AF02-0D47-5BDC-46CBACCEF8A2}\BuilderCamera.dll (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [1844](2015-12-19 18:05:20) 0000000071440000 Process C:\ProgramData\ApplicationHosting\ApplicationHosting.exe (*** suspicious ***) @ C:\ProgramData\ApplicationHosting\ApplicationHosting.exe [1900](2015-12-19 18:03:44) 0000000000a90000 Process C:\ProgramData\Solotough\Solotough.exe (*** suspicious ***) @ C:\ProgramData\Solotough\Solotough.exe [2188](2015-12-19 18:03:59) 0000000000f70000 Library C:\Users\user\AppData\Roaming\WinNetSvc\Interface.dll (*** suspicious ***) @ C:\Users\user\AppData\Roaming\WinNetSvc\WinNetSvc.exe [2308](2015-12-19 18:27:39) 000000006b6d0000 Process C:\ProgramData\Solotough\Solotough.exe (*** suspicious ***) @ C:\ProgramData\Solotough\Solotough.exe [3352](2015-12-19 18:03:59) 0000000000f70000 ---- Files - GMER 2.1 ---- File C:\Users\user\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt 4 bytes File C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache 6 bytes ---- EOF - GMER 2.1 ----