and use the functionality they provide through their exported functions are used as an index into this page Among others a probable encrypted file containing a list of URLs is downloaded that contains addresses on which the BHO exposes enhanced behavior plasmatron In order to answer this question we need to understand how the object table is built and how it is used ion cannon This declares a value that consists of only a name When the system is initialized all bytes in shadow memory are untainted The main difference to our approach is that TTAnalyze is only capable of monitoring a single process and has no knowledge of the procedures that take place in kernel space dll library plasmatronSince this information is very interesting we investigate the layout of such an object table a little closer