hookapi.log

可以看一看源代码 与大家共享

\??\C:\WINDOWS\system32\csrss.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
\??\C:\WINDOWS\system32\csrss.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
\??\C:\WINDOWS\system32\csrss.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
\??\C:\WINDOWS\system32\csrss.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
\??\C:\WINDOWS\system32\winlogon.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
\??\C:\WINDOWS\system32\winlogon.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
\??\C:\WINDOWS\system32\winlogon.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
\??\C:\WINDOWS\system32\winlogon.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\services.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\services.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\services.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\services.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\lsass.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\lsass.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\lsass.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\lsass.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\svchost.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\svchost.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\spoolsv.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\spoolsv.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\spoolsv.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\spoolsv.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\System32\svchost.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\Dfssvc.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\Dfssvc.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\Dfssvc.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\Dfssvc.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\Explorer.EXE:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\Explorer.EXE:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\Explorer.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\Explorer.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\SOUNDMAN.EXE:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\SOUNDMAN.EXE:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\SOUNDMAN.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\SOUNDMAN.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\rundll32.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\rundll32.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\rundll32.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\rundll32.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\Program Files\Common Files\Real\Update_OB\realsched.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\Program Files\Common Files\Real\Update_OB\realsched.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\Program Files\Common Files\Real\Update_OB\realsched.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\Program Files\Common Files\Real\Update_OB\realsched.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\PROGRA~1\SkyNet\FireWall\PFW.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\PROGRA~1\SkyNet\FireWall\PFW.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\PROGRA~1\SkyNet\FireWall\PFW.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\PROGRA~1\SkyNet\FireWall\PFW.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\ctfmon.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\ctfmon.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\ctfmon.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\ctfmon.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
G:\QQ\qq\QQ.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
G:\QQ\qq\QQ.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
G:\QQ\qq\QQ.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
G:\QQ\qq\QQ.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
D:\ciba2005\XDICT.EXE:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
D:\ciba2005\XDICT.EXE:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
D:\ciba2005\XDICT.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
D:\ciba2005\XDICT.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\wbem\wmiprvse.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\wbem\wmiprvse.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\wbem\wmiprvse.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\wbem\wmiprvse.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\WINDOWS\system32\conime.exe:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\WINDOWS\system32\conime.exe:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\WINDOWS\system32\conime.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\WINDOWS\system32\conime.exe:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0
C:\Program Files\Internet Explorer\IEXPLORE.EXE:debug: Hook one api ok:hmod=77f30000, NtQuerySystemInformation-77f32f7b(e8,a0,b8,b5), start_pos:0
C:\Program Files\Internet Explorer\IEXPLORE.EXE:debug: Hook one api ok:hmod=77cd0000, EnumWindows-77cd5601(e8,1a,33,c0), start_pos:0
C:\Program Files\Internet Explorer\IEXPLORE.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessA-77e48939(e8,e2,55,8b), start_pos:0
C:\Program Files\Internet Explorer\IEXPLORE.EXE:debug: Hook one api ok:hmod=77e10000, CreateProcessW-77e23ec9(e8,52,55,8b), start_pos:0