GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-04-07 11:19:57 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006b WDC_WD50 rev.01.0 465,76GB Running: 1nhhy0si.exe; Driver: C:\Users\Giant\AppData\Local\Temp\fxldqpog.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800039a9000 65 bytes [00, 00, 15, 02, 46, 69, 6C, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594 fffff800039a9042 4 bytes [00, 00, 00, 00] ---- User code sections - GMER 2.1 ---- .text C:\PROGRA~2\SPEEDB~1\VideoAcceleratorService.exe[1484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000752e1465 2 bytes [2E, 75] .text C:\PROGRA~2\SPEEDB~1\VideoAcceleratorService.exe[1484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000752e14bb 2 bytes [2E, 75] .text ... * 2 .text D:\Dokumenty\SpyShelter Premium\SpyShelter.exe[1648] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007784c4dd 5 bytes JMP 0000000174c4a3b0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!RtlAdjustPrivilege 000000007763a7d0 5 bytes JMP 0000000100ab27a0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077653b10 5 bytes JMP 0000000175091f00 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077657ac0 5 bytes JMP 0000000175091e60 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk 000000007765c340 5 bytes JMP 00000000777e0008 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx 00000000776692d0 5 bytes JMP 00000001750945e0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!RtlGetCurrentDirectory_U 000000007767b130 5 bytes JMP 0000000175071140 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!RtlSetCurrentDirectory_U 000000007767b470 5 bytes JMP 00000001750713d0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryElevationFlags 000000007767b870 5 bytes JMP 000000017509f840 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!LdrQueryImageFileExecutionOptions 000000007767bb60 5 bytes JMP 0000000175091fc0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPagesScatter 00000000776812e0 4 bytes [49, C7, C2, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPagesScatter + 7 00000000776812e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForSingleObject 00000000776812f0 5 bytes [49, C7, C2, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForSingleObject + 7 00000000776812f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile 0000000077681310 5 bytes JMP 0000000175066e30 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 7 0000000077681317 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeviceIoControlFile 0000000077681320 5 bytes JMP 0000000175070360 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeviceIoControlFile + 7 0000000077681327 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077681330 5 bytes JMP 0000000175066f50 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 7 0000000077681337 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletion 0000000077681340 5 bytes [49, C7, C2, 06, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletion + 7 0000000077681347 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseSemaphore 0000000077681350 5 bytes [49, C7, C2, 07, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseSemaphore + 7 0000000077681357 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000077681360 5 bytes [49, C7, C2, 08, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort + 7 0000000077681367 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyPort 0000000077681370 5 bytes [49, C7, C2, 09, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyPort + 7 0000000077681377 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077681380 5 bytes [49, C7, C2, 0A, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 7 0000000077681387 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetEvent 0000000077681390 5 bytes [49, C7, C2, 0B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetEvent + 7 0000000077681397 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000776813a0 5 bytes JMP 00000001750735d0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 7 00000000776813a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000776813b0 5 bytes JMP 0000000175093b20 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject + 7 00000000776813b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationFile 00000000776813c0 5 bytes JMP 0000000175075ae0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationFile + 7 00000000776813c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey 00000000776813d0 5 bytes JMP 0000000175090b00 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 7 00000000776813d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateValueKey 00000000776813e0 5 bytes JMP 0000000175090620 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateValueKey + 7 00000000776813e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFindAtom 00000000776813f0 5 bytes [49, C7, C2, 11, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFindAtom + 7 00000000776813f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultLocale 0000000077681400 5 bytes [49, C7, C2, 12, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultLocale + 7 0000000077681407 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryKey 0000000077681410 5 bytes JMP 0000000175090fb0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryKey + 7 0000000077681417 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryValueKey 0000000077681420 5 bytes JMP 0000000175090270 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryValueKey + 7 0000000077681427 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077681430 5 bytes [49, C7, C2, 15, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory + 7 0000000077681437 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationProcess 0000000077681440 5 bytes [49, C7, C2, 16, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationProcess + 7 0000000077681447 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects32 0000000077681450 5 bytes [49, C7, C2, 17, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects32 + 7 0000000077681457 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFileGather 0000000077681460 5 bytes [49, C7, C2, 18, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFileGather + 7 0000000077681467 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077681470 5 bytes JMP 00000001750952e0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 7 0000000077681477 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey 0000000077681480 5 bytes JMP 000000017508f8f0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 7 0000000077681487 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077681490 5 bytes [49, C7, C2, 1B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory + 7 0000000077681497 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 00000000776814a0 5 bytes JMP 0000000175086860 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 7 00000000776814a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseMutant 00000000776814b0 5 bytes [49, C7, C2, 1D, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseMutant + 7 00000000776814b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationToken 00000000776814c0 5 bytes [49, C7, C2, 1E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationToken + 7 00000000776814c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRequestWaitReplyPort 00000000776814d0 5 bytes JMP 0000000175086f00 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRequestWaitReplyPort + 7 00000000776814d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVirtualMemory 00000000776814e0 5 bytes JMP 0000000175093db0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVirtualMemory + 7 00000000776814e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000776814f0 5 bytes [49, C7, C2, 21, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 7 00000000776814f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077681500 5 bytes [49, C7, C2, 22, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread + 7 0000000077681507 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077681510 5 bytes JMP 00000001750a0040 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 7 0000000077681517 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000077681520 5 bytes JMP 0000000175075fc0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 7 0000000077681527 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckAndAuditAlarm 0000000077681540 5 bytes [49, C7, C2, 26, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckAndAuditAlarm + 7 0000000077681547 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077681550 5 bytes [49, C7, C2, 27, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 7 0000000077681557 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000077681560 5 bytes [49, C7, C2, 28, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx + 7 0000000077681567 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetEventBoostPriority 0000000077681580 5 bytes [49, C7, C2, 2A, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetEventBoostPriority + 7 0000000077681587 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadFileScatter 0000000077681590 5 bytes [49, C7, C2, 2B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadFileScatter + 7 0000000077681597 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000776815a0 5 bytes [49, C7, C2, 2C, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 7 00000000776815a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000776815b0 5 bytes [49, C7, C2, 2D, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 7 00000000776815b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPerformanceCounter 00000000776815c0 5 bytes [49, C7, C2, 2E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPerformanceCounter + 7 00000000776815c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateKey 00000000776815d0 5 bytes JMP 000000017508fda0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateKey + 7 00000000776815d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000776815e0 5 bytes JMP 00000001750763c0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 7 00000000776815e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDelayExecution 00000000776815f0 5 bytes [49, C7, C2, 31, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDelayExecution + 7 00000000776815f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077681600 1 byte JMP 0000000175070590 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 2 0000000077681602 3 bytes {JMP 0xfffffffffd9eef90} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformation 0000000077681610 5 bytes JMP 00000001750a2be0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformation + 7 0000000077681617 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077681620 5 bytes JMP 0000000175089e60 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 7 0000000077681627 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimer 0000000077681630 5 bytes [49, C7, C2, 35, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimer + 7 0000000077681637 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFsControlFile 0000000077681640 5 bytes JMP 0000000175073370 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFsControlFile + 7 0000000077681647 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077681650 5 bytes [49, C7, C2, 37, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 7 0000000077681657 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCloseObjectAuditAlarm 0000000077681660 5 bytes [49, C7, C2, 38, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCloseObjectAuditAlarm + 7 0000000077681667 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077681670 5 bytes JMP 00000001750a0120 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 7 0000000077681677 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000077681680 5 bytes JMP 00000001750723b0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 7 0000000077681687 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtClearEvent 0000000077681690 5 bytes [49, C7, C2, 3B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtClearEvent + 7 0000000077681697 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadVirtualMemory 00000000776816a0 5 bytes [49, C7, C2, 3C, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadVirtualMemory + 7 00000000776816a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000776816b0 5 bytes JMP 00000001750891f0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent + 7 00000000776816b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00000000776816c0 5 bytes JMP 000000017509f800 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken + 7 00000000776816c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateToken 00000000776816d0 5 bytes [49, C7, C2, 3F, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateToken + 7 00000000776816d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultUILanguage 00000000776816f0 5 bytes [49, C7, C2, 41, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultUILanguage + 7 00000000776816f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077681700 5 bytes [49, C7, C2, 42, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 7 0000000077681707 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtYieldExecution 0000000077681710 5 bytes [49, C7, C2, 43, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtYieldExecution + 7 0000000077681717 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAddAtom 0000000077681720 5 bytes [49, C7, C2, 44, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAddAtom + 7 0000000077681727 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000077681730 5 bytes JMP 0000000175088fa0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 7 0000000077681737 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVolumeInformationFile 0000000077681740 5 bytes JMP 0000000175073840 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVolumeInformationFile + 7 0000000077681747 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077681750 5 bytes JMP 0000000175089b60 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 7 0000000077681757 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushBuffersFile 0000000077681760 5 bytes [49, C7, C2, 48, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushBuffersFile + 7 0000000077681767 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtApphelpCacheControl 0000000077681770 5 bytes [49, C7, C2, 49, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtApphelpCacheControl + 7 0000000077681777 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077681780 5 bytes [49, C7, C2, 4A, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 7 0000000077681787 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077681790 5 bytes [49, C7, C2, 4B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 7 0000000077681797 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtIsProcessInJob 00000000776817a0 5 bytes [49, C7, C2, 4C, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtIsProcessInJob + 7 00000000776817a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000776817b0 5 bytes [49, C7, C2, 4D, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 7 00000000776817b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySection 00000000776817c0 5 bytes [49, C7, C2, 4E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySection + 7 00000000776817c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000776817d0 5 bytes [49, C7, C2, 4F, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 7 00000000776817d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadRequestData 00000000776817f0 5 bytes [49, C7, C2, 51, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadRequestData + 7 00000000776817f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077681800 5 bytes JMP 0000000175074240 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 7 0000000077681807 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEvent 0000000077681810 5 bytes [49, C7, C2, 53, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEvent + 7 0000000077681817 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteRequestData 0000000077681820 5 bytes [49, C7, C2, 54, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWriteRequestData + 7 0000000077681827 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenDirectoryObject 0000000077681830 5 bytes [49, C7, C2, 55, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenDirectoryObject + 7 0000000077681837 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeAndAuditAlarm 0000000077681840 5 bytes [49, C7, C2, 56, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeAndAuditAlarm + 7 0000000077681847 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects 0000000077681860 5 bytes [49, C7, C2, 58, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects + 7 0000000077681867 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationObject 0000000077681870 5 bytes [49, C7, C2, 59, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationObject + 7 0000000077681877 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFile 0000000077681880 5 bytes [49, C7, C2, 5A, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFile + 7 0000000077681887 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTraceEvent 0000000077681890 5 bytes JMP 00000001750a28c0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTraceEvent + 7 0000000077681897 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPowerInformation 00000000776818a0 5 bytes [49, C7, C2, 5C, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPowerInformation + 7 00000000776818a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000776818b0 5 bytes JMP 000000017508e580 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 7 00000000776818b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelTimer 00000000776818c0 5 bytes [49, C7, C2, 5E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelTimer + 7 00000000776818c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimer 00000000776818d0 5 bytes [49, C7, C2, 5F, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimer + 7 00000000776818d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAcceptConnectPort 00000000776818e0 5 bytes [49, C7, C2, 60, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAcceptConnectPort + 7 00000000776818e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheck 00000000776818f0 5 bytes [49, C7, C2, 61, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheck + 7 00000000776818f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077681900 5 bytes [49, C7, C2, 62, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType + 7 0000000077681907 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultList 0000000077681910 5 bytes [49, C7, C2, 63, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultList + 7 0000000077681917 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm 0000000077681920 5 bytes [49, C7, C2, 64, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm + 7 0000000077681927 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0000000077681930 5 bytes [49, C7, C2, 65, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle + 7 0000000077681937 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000077681940 5 bytes [49, C7, C2, 66, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 7 0000000077681947 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAddDriverEntry 0000000077681950 5 bytes [49, C7, C2, 67, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAddDriverEntry + 7 0000000077681957 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustGroupsToken 0000000077681960 5 bytes [49, C7, C2, 68, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustGroupsToken + 7 0000000077681967 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlertResumeThread 0000000077681970 5 bytes [49, C7, C2, 69, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlertResumeThread + 7 0000000077681977 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlertThread 0000000077681980 5 bytes [49, C7, C2, 6A, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlertThread + 7 0000000077681987 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateLocallyUniqueId 0000000077681990 5 bytes [49, C7, C2, 6B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateLocallyUniqueId + 7 0000000077681997 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateReserveObject 00000000776819a0 5 bytes [49, C7, C2, 6C, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateReserveObject + 7 00000000776819a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUserPhysicalPages 00000000776819b0 5 bytes [49, C7, C2, 6D, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUserPhysicalPages + 7 00000000776819b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUuids 00000000776819c0 5 bytes [49, C7, C2, 6E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUuids + 7 00000000776819c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcAcceptConnectPort 00000000776819d0 5 bytes [49, C7, C2, 6F, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcAcceptConnectPort + 7 00000000776819d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCancelMessage 00000000776819e0 5 bytes [49, C7, C2, 70, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCancelMessage + 7 00000000776819e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00000000776819f0 5 bytes JMP 00000001750886d0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort + 7 00000000776819f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 0000000077681a00 5 bytes JMP 0000000175088520 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort + 7 0000000077681a07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePortSection 0000000077681a10 5 bytes [49, C7, C2, 73, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePortSection + 7 0000000077681a17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateResourceReserve 0000000077681a20 5 bytes [49, C7, C2, 74, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateResourceReserve + 7 0000000077681a27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSectionView 0000000077681a30 5 bytes [49, C7, C2, 75, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSectionView + 7 0000000077681a37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSecurityContext 0000000077681a40 5 bytes [49, C7, C2, 76, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSecurityContext + 7 0000000077681a47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeletePortSection 0000000077681a50 5 bytes [49, C7, C2, 77, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeletePortSection + 7 0000000077681a57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteResourceReserve 0000000077681a60 5 bytes [49, C7, C2, 78, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteResourceReserve + 7 0000000077681a67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSectionView 0000000077681a70 5 bytes [49, C7, C2, 79, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSectionView + 7 0000000077681a77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSecurityContext 0000000077681a80 5 bytes [49, C7, C2, 7A, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSecurityContext + 7 0000000077681a87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDisconnectPort 0000000077681a90 5 bytes [49, C7, C2, 7B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDisconnectPort + 7 0000000077681a97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077681aa0 5 bytes JMP 0000000175086890 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort + 7 0000000077681aa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderProcess 0000000077681ab0 5 bytes [49, C7, C2, 7D, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderProcess + 7 0000000077681ab7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderThread 0000000077681ac0 5 bytes [49, C7, C2, 7E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderThread + 7 0000000077681ac7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformation 0000000077681ad0 5 bytes JMP 0000000175086520 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformation + 7 0000000077681ad7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformationMessage 0000000077681ae0 5 bytes JMP 0000000175086550 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformationMessage + 7 0000000077681ae7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcRevokeSecurityContext 0000000077681af0 5 bytes [49, C7, C2, 81, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcRevokeSecurityContext + 7 0000000077681af7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000077681b00 5 bytes JMP 0000000175087100 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort + 7 0000000077681b07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSetInformation 0000000077681b10 5 bytes [49, C7, C2, 83, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSetInformation + 7 0000000077681b17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAreMappedFilesTheSame 0000000077681b20 5 bytes [49, C7, C2, 84, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAreMappedFilesTheSame + 7 0000000077681b27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000077681b30 5 bytes JMP 00000001750a2d00 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject + 7 0000000077681b37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFileEx 0000000077681b40 5 bytes [49, C7, C2, 86, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFileEx + 7 0000000077681b47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelSynchronousIoFile 0000000077681b50 5 bytes [49, C7, C2, 87, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCancelSynchronousIoFile + 7 0000000077681b57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCommitComplete 0000000077681b60 5 bytes [49, C7, C2, 88, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCommitComplete + 7 0000000077681b67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCommitEnlistment 0000000077681b70 5 bytes [49, C7, C2, 89, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCommitEnlistment + 7 0000000077681b77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCommitTransaction 0000000077681b80 5 bytes [49, C7, C2, 8A, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCommitTransaction + 7 0000000077681b87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompactKeys 0000000077681b90 5 bytes [49, C7, C2, 8B, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompactKeys + 7 0000000077681b97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompareTokens 0000000077681ba0 5 bytes [49, C7, C2, 8C, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompareTokens + 7 0000000077681ba7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompleteConnectPort 0000000077681bb0 5 bytes [49, C7, C2, 8D, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompleteConnectPort + 7 0000000077681bb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompressKey 0000000077681bc0 5 bytes [49, C7, C2, 8E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCompressKey + 7 0000000077681bc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 0000000077681bd0 5 bytes JMP 0000000175087f10 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort + 7 0000000077681bd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDebugObject 0000000077681be0 5 bytes [49, C7, C2, 90, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDebugObject + 7 0000000077681be7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDirectoryObject 0000000077681bf0 5 bytes [49, C7, C2, 91, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDirectoryObject + 7 0000000077681bf7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEnlistment 0000000077681c00 5 bytes [49, C7, C2, 92, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEnlistment + 7 0000000077681c07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000077681c10 5 bytes [49, C7, C2, 93, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair + 7 0000000077681c17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000077681c20 5 bytes [49, C7, C2, 94, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion + 7 0000000077681c27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobObject 0000000077681c30 5 bytes JMP 00000001750a29d0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobObject + 7 0000000077681c37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobSet 0000000077681c40 5 bytes [49, C7, C2, 96, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobSet + 7 0000000077681c47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyTransacted 0000000077681c50 5 bytes [49, C7, C2, 97, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyTransacted + 7 0000000077681c57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyedEvent 0000000077681c60 5 bytes [49, C7, C2, 98, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyedEvent + 7 0000000077681c67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMailslotFile 0000000077681c70 5 bytes JMP 000000017506fcc0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMailslotFile + 7 0000000077681c77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000077681c80 5 bytes JMP 00000001750893a0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 7 0000000077681c87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateNamedPipeFile 0000000077681c90 5 bytes JMP 000000017506fef0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateNamedPipeFile + 7 0000000077681c97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePagingFile 0000000077681ca0 5 bytes [49, C7, C2, 9C, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePagingFile + 7 0000000077681ca7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 0000000077681cb0 5 bytes JMP 0000000175087d10 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort + 7 0000000077681cb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePrivateNamespace 0000000077681cc0 5 bytes [49, C7, C2, 9E, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePrivateNamespace + 7 0000000077681cc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess 0000000077681cd0 5 bytes [49, C7, C2, 9F, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 7 0000000077681cd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfile 0000000077681ce0 5 bytes [49, C7, C2, A0, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfile + 7 0000000077681ce7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfileEx 0000000077681cf0 5 bytes [49, C7, C2, A1, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfileEx + 7 0000000077681cf7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateResourceManager 0000000077681d00 5 bytes [49, C7, C2, A2, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateResourceManager + 7 0000000077681d07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000077681d10 5 bytes JMP 0000000175089760 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore + 7 0000000077681d17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 0000000077681d20 5 bytes [49, C7, C2, A4, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject + 7 0000000077681d27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077681d30 5 bytes [49, C7, C2, A5, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 7 0000000077681d37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000077681d40 5 bytes [49, C7, C2, A6, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 7 0000000077681d47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateToken 0000000077681d50 5 bytes [49, C7, C2, A7, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateToken + 7 0000000077681d57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransaction 0000000077681d60 5 bytes [49, C7, C2, A8, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransaction + 7 0000000077681d67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransactionManager 0000000077681d70 5 bytes [49, C7, C2, A9, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransactionManager + 7 0000000077681d77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess 0000000077681d80 5 bytes [49, C7, C2, AA, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 7 0000000077681d87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWaitablePort 0000000077681d90 5 bytes [49, C7, C2, AB, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWaitablePort + 7 0000000077681d97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWorkerFactory 0000000077681da0 5 bytes [49, C7, C2, AC, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWorkerFactory + 7 0000000077681da7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000077681db0 5 bytes [49, C7, C2, AD, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess + 7 0000000077681db7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDebugContinue 0000000077681dc0 5 bytes [49, C7, C2, AE, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDebugContinue + 7 0000000077681dc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteAtom 0000000077681dd0 5 bytes [49, C7, C2, AF, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteAtom + 7 0000000077681dd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000077681de0 5 bytes [49, C7, C2, B0, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry + 7 0000000077681de7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteDriverEntry 0000000077681df0 5 bytes [49, C7, C2, B1, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteDriverEntry + 7 0000000077681df7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile 0000000077681e00 1 byte JMP 000000017506a190 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 2 0000000077681e02 3 bytes {JMP 0xfffffffffd9e8390} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey 0000000077681e10 5 bytes JMP 0000000175090fd0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 7 0000000077681e17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteObjectAuditAlarm 0000000077681e20 5 bytes [49, C7, C2, B4, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteObjectAuditAlarm + 7 0000000077681e27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeletePrivateNamespace 0000000077681e30 5 bytes [49, C7, C2, B5, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeletePrivateNamespace + 7 0000000077681e37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077681e40 5 bytes JMP 0000000175090e20 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 7 0000000077681e47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDisableLastKnownGood 0000000077681e50 5 bytes [49, C7, C2, B7, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDisableLastKnownGood + 7 0000000077681e57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDisplayString 0000000077681e60 3 bytes [49, C7, C2] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDisplayString + 4 0000000077681e64 1 byte [00] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDrawText 0000000077681e70 5 bytes [49, C7, C2, B9, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtDrawText + 7 0000000077681e77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnableLastKnownGood 0000000077681e80 5 bytes [49, C7, C2, BA, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnableLastKnownGood + 7 0000000077681e87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateBootEntries 0000000077681e90 5 bytes [49, C7, C2, BB, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateBootEntries + 7 0000000077681e97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateDriverEntries 0000000077681ea0 5 bytes [49, C7, C2, BC, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateDriverEntries + 7 0000000077681ea7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateSystemEnvironmentValuesEx 0000000077681eb0 5 bytes [49, C7, C2, BD, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateSystemEnvironmentValuesEx + 7 0000000077681eb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateTransactionObject 0000000077681ec0 5 bytes [49, C7, C2, BE, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateTransactionObject + 7 0000000077681ec7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtExtendSection 0000000077681ed0 5 bytes [49, C7, C2, BF, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtExtendSection + 7 0000000077681ed7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFilterToken 0000000077681ee0 5 bytes [49, C7, C2, C0, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFilterToken + 7 0000000077681ee7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstallUILanguage 0000000077681ef0 5 bytes [49, C7, C2, C1, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstallUILanguage + 7 0000000077681ef7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstructionCache 0000000077681f00 5 bytes [49, C7, C2, C2, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstructionCache + 7 0000000077681f07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushKey 0000000077681f10 5 bytes [49, C7, C2, C3, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushKey + 7 0000000077681f17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushProcessWriteBuffers 0000000077681f20 5 bytes [49, C7, C2, C4, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushProcessWriteBuffers + 7 0000000077681f27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushVirtualMemory 0000000077681f30 5 bytes [49, C7, C2, C5, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushVirtualMemory + 7 0000000077681f37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushWriteBuffer 0000000077681f40 5 bytes [49, C7, C2, C6, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFlushWriteBuffer + 7 0000000077681f47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreeUserPhysicalPages 0000000077681f50 5 bytes [49, C7, C2, C7, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreeUserPhysicalPages + 7 0000000077681f57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeRegistry 0000000077681f60 5 bytes [49, C7, C2, C8, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeRegistry + 7 0000000077681f67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeTransactions 0000000077681f70 5 bytes [49, C7, C2, C9, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeTransactions + 7 0000000077681f77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077681f80 5 bytes [49, C7, C2, CA, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread + 7 0000000077681f87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetCurrentProcessorNumber 0000000077681f90 5 bytes [49, C7, C2, CB, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetCurrentProcessorNumber + 7 0000000077681f97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetDevicePowerState 0000000077681fa0 5 bytes [49, C7, C2, CC, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetDevicePowerState + 7 0000000077681fa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetMUIRegistryInfo 0000000077681fb0 5 bytes [49, C7, C2, CD, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetMUIRegistryInfo + 7 0000000077681fb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextProcess 0000000077681fc0 5 bytes [49, C7, C2, CE, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextProcess + 7 0000000077681fc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextThread 0000000077681fd0 5 bytes [49, C7, C2, CF, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextThread + 7 0000000077681fd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNlsSectionPtr 0000000077681fe0 5 bytes [49, C7, C2, D0, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNlsSectionPtr + 7 0000000077681fe7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNotificationResourceManager 0000000077681ff0 5 bytes [49, C7, C2, D1, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetNotificationResourceManager + 7 0000000077681ff7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetPlugPlayEvent 0000000077682000 5 bytes [49, C7, C2, D2, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetPlugPlayEvent + 7 0000000077682007 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetWriteWatch 0000000077682010 5 bytes [49, C7, C2, D3, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtGetWriteWatch + 7 0000000077682017 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateAnonymousToken 0000000077682020 5 bytes JMP 00000001750868c0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateAnonymousToken + 7 0000000077682027 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateThread 0000000077682030 5 bytes JMP 0000000175086910 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateThread + 7 0000000077682037 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeNlsFiles 0000000077682040 5 bytes [49, C7, C2, D6, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeNlsFiles + 7 0000000077682047 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeRegistry 0000000077682050 5 bytes [49, C7, C2, D7, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeRegistry + 7 0000000077682057 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtInitiatePowerAction 0000000077682060 5 bytes [49, C7, C2, D8, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtInitiatePowerAction + 7 0000000077682067 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtIsSystemResumeAutomatic 0000000077682070 5 bytes [49, C7, C2, D9, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtIsSystemResumeAutomatic + 7 0000000077682077 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtIsUILanguageComitted 0000000077682080 5 bytes [49, C7, C2, DA, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtIsUILanguageComitted + 7 0000000077682087 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtListenPort 0000000077682090 5 bytes [49, C7, C2, DB, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtListenPort + 7 0000000077682097 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000776820a0 5 bytes JMP 00000001750922e0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 7 00000000776820a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey 00000000776820b0 5 bytes JMP 000000017508dac0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey + 7 00000000776820b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey2 00000000776820c0 5 bytes [49, C7, C2, DE, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey2 + 7 00000000776820c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKeyEx 00000000776820d0 5 bytes [49, C7, C2, DF, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKeyEx + 7 00000000776820d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockFile 00000000776820e0 5 bytes [49, C7, C2, E0, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockFile + 7 00000000776820e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockProductActivationKeys 00000000776820f0 5 bytes [49, C7, C2, E1, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockProductActivationKeys + 7 00000000776820f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockRegistryKey 0000000077682100 5 bytes [49, C7, C2, E2, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockRegistryKey + 7 0000000077682107 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockVirtualMemory 0000000077682110 5 bytes [49, C7, C2, E3, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtLockVirtualMemory + 7 0000000077682117 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMakePermanentObject 0000000077682120 5 bytes [49, C7, C2, E4, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMakePermanentObject + 7 0000000077682127 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 0000000077682130 5 bytes [49, C7, C2, E5, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject + 7 0000000077682137 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMapCMFModule 0000000077682140 5 bytes [49, C7, C2, E6, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMapCMFModule + 7 0000000077682147 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPages 0000000077682150 5 bytes [49, C7, C2, E7, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPages + 7 0000000077682157 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000077682160 5 bytes [49, C7, C2, E8, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 7 0000000077682167 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtModifyDriverEntry 0000000077682170 5 bytes [49, C7, C2, E9, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtModifyDriverEntry + 7 0000000077682177 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeDirectoryFile 0000000077682180 5 bytes [49, C7, C2, EA, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeDirectoryFile + 7 0000000077682187 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000077682190 5 bytes JMP 000000017508e750 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey + 7 0000000077682197 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000776821a0 5 bytes JMP 000000017508d520 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys + 7 00000000776821a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeSession 00000000776821b0 5 bytes [49, C7, C2, ED, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeSession + 7 00000000776821b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEnlistment 00000000776821c0 5 bytes [49, C7, C2, EE, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEnlistment + 7 00000000776821c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000776821d0 5 bytes [49, C7, C2, EF, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair + 7 00000000776821d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000776821e0 5 bytes [49, C7, C2, F0, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion + 7 00000000776821e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenJobObject 00000000776821f0 5 bytes [49, C7, C2, F1, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenJobObject + 7 00000000776821f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx 0000000077682200 5 bytes JMP 000000017508f8c0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 7 0000000077682207 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransacted 0000000077682210 5 bytes [49, C7, C2, F3, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransacted + 7 0000000077682217 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransactedEx 0000000077682220 5 bytes [49, C7, C2, F4, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransactedEx + 7 0000000077682227 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyedEvent 0000000077682230 5 bytes [49, C7, C2, F5, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyedEvent + 7 0000000077682237 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000077682240 5 bytes JMP 00000001750895b0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant + 7 0000000077682247 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenObjectAuditAlarm 0000000077682250 5 bytes [49, C7, C2, F7, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenObjectAuditAlarm + 7 0000000077682257 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenPrivateNamespace 0000000077682260 5 bytes [49, C7, C2, F8, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenPrivateNamespace + 7 0000000077682267 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000077682270 5 bytes [49, C7, C2, F9, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 7 0000000077682277 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenResourceManager 0000000077682280 5 bytes [49, C7, C2, FA, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenResourceManager + 7 0000000077682287 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000077682290 5 bytes JMP 00000001750899b0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore + 7 0000000077682297 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSession 00000000776822a0 5 bytes [49, C7, C2, FC, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSession + 7 00000000776822a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSymbolicLinkObject 00000000776822b0 5 bytes [49, C7, C2, FD, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSymbolicLinkObject + 7 00000000776822b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000776822c0 2 bytes JMP 000000017509f420 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 3 00000000776822c3 2 bytes [A1, FD] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000776822d0 5 bytes [49, C7, C2, FF, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer + 7 00000000776822d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransaction 00000000776822e0 6 bytes [49, C7, C2, 00, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransaction + 7 00000000776822e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransactionManager 00000000776822f0 4 bytes [49, C7, C2, 01] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransactionManager + 5 00000000776822f5 1 byte [00] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPlugPlayControl 0000000077682300 6 bytes [49, C7, C2, 02, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPlugPlayControl + 7 0000000077682307 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareComplete 0000000077682310 6 bytes [49, C7, C2, 03, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareComplete + 7 0000000077682317 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareEnlistment 0000000077682320 6 bytes [49, C7, C2, 04, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareEnlistment + 7 0000000077682327 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareComplete 0000000077682330 6 bytes [49, C7, C2, 05, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareComplete + 7 0000000077682337 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareEnlistment 0000000077682340 6 bytes [49, C7, C2, 06, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareEnlistment + 7 0000000077682347 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeCheck 0000000077682350 6 bytes [49, C7, C2, 07, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeCheck + 7 0000000077682357 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeObjectAuditAlarm 0000000077682360 6 bytes [49, C7, C2, 08, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeObjectAuditAlarm + 7 0000000077682367 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegedServiceAuditAlarm 0000000077682370 6 bytes [49, C7, C2, 09, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegedServiceAuditAlarm + 7 0000000077682377 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationComplete 0000000077682380 6 bytes [49, C7, C2, 0A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationComplete + 7 0000000077682387 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationFailed 0000000077682390 6 bytes [49, C7, C2, 0B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationFailed + 7 0000000077682397 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPulseEvent 00000000776823a0 6 bytes [49, C7, C2, 0C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtPulseEvent + 7 00000000776823a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootEntryOrder 00000000776823b0 6 bytes [49, C7, C2, 0D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootEntryOrder + 7 00000000776823b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootOptions 00000000776823c0 6 bytes [49, C7, C2, 0E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootOptions + 7 00000000776823c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDebugFilterState 00000000776823d0 6 bytes [49, C7, C2, 0F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDebugFilterState + 7 00000000776823d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryObject 00000000776823e0 6 bytes [49, C7, C2, 10, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryObject + 7 00000000776823e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDriverEntryOrder 00000000776823f0 6 bytes [49, C7, C2, 11, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDriverEntryOrder + 7 00000000776823f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEaFile 0000000077682400 6 bytes [49, C7, C2, 12, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEaFile + 7 0000000077682407 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000077682410 6 bytes JMP 0000000175072400 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 7 0000000077682417 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationAtom 0000000077682420 6 bytes [49, C7, C2, 14, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationAtom + 7 0000000077682427 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationEnlistment 0000000077682430 6 bytes [49, C7, C2, 15, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationEnlistment + 7 0000000077682437 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationJobObject 0000000077682440 6 bytes [49, C7, C2, 16, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationJobObject + 7 0000000077682447 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationPort 0000000077682450 6 bytes [49, C7, C2, 17, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationPort + 7 0000000077682457 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationResourceManager 0000000077682460 6 bytes [49, C7, C2, 18, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationResourceManager + 7 0000000077682467 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransaction 0000000077682470 6 bytes [49, C7, C2, 19, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransaction + 7 0000000077682477 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransactionManager 0000000077682480 6 bytes [49, C7, C2, 1A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransactionManager + 7 0000000077682487 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationWorkerFactory 0000000077682490 6 bytes [49, C7, C2, 1B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationWorkerFactory + 7 0000000077682497 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInstallUILanguage 00000000776824a0 6 bytes [49, C7, C2, 1C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInstallUILanguage + 7 00000000776824a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIntervalProfile 00000000776824b0 6 bytes [49, C7, C2, 1D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIntervalProfile + 7 00000000776824b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIoCompletion 00000000776824c0 6 bytes [49, C7, C2, 1E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIoCompletion + 7 00000000776824c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryLicenseValue 00000000776824d0 6 bytes [49, C7, C2, 1F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryLicenseValue + 7 00000000776824d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMultipleValueKey 00000000776824e0 6 bytes JMP 0000000175090830 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMultipleValueKey + 7 00000000776824e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMutant 00000000776824f0 6 bytes [49, C7, C2, 21, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMutant + 7 00000000776824f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeys 0000000077682500 6 bytes [49, C7, C2, 22, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeys + 7 0000000077682507 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeysEx 0000000077682510 6 bytes [49, C7, C2, 23, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeysEx + 7 0000000077682517 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPortInformationProcess 0000000077682520 6 bytes [49, C7, C2, 24, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPortInformationProcess + 7 0000000077682527 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryQuotaInformationFile 0000000077682530 6 bytes [49, C7, C2, 25, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryQuotaInformationFile + 7 0000000077682537 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityAttributesToken 0000000077682540 6 bytes [49, C7, C2, 26, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityAttributesToken + 7 0000000077682547 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityObject 0000000077682550 6 bytes JMP 000000017509f4a0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityObject + 7 0000000077682557 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySemaphore 0000000077682560 6 bytes [49, C7, C2, 28, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySemaphore + 7 0000000077682567 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySymbolicLinkObject 0000000077682570 6 bytes [49, C7, C2, 29, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySymbolicLinkObject + 7 0000000077682577 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValue 0000000077682580 6 bytes [49, C7, C2, 2A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValue + 7 0000000077682587 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValueEx 0000000077682590 6 bytes [49, C7, C2, 2B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValueEx + 7 0000000077682597 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformationEx 00000000776825a0 6 bytes [49, C7, C2, 2C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformationEx + 7 00000000776825a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimerResolution 00000000776825b0 6 bytes [49, C7, C2, 2D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimerResolution + 7 00000000776825b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000776825c0 6 bytes [49, C7, C2, 2E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx + 7 00000000776825c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError 00000000776825e0 6 bytes [49, C7, C2, 30, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 7 00000000776825e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadOnlyEnlistment 00000000776825f0 6 bytes [49, C7, C2, 31, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReadOnlyEnlistment + 7 00000000776825f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverEnlistment 0000000077682600 6 bytes [49, C7, C2, 32, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverEnlistment + 7 0000000077682607 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverResourceManager 0000000077682610 6 bytes [49, C7, C2, 33, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverResourceManager + 7 0000000077682617 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverTransactionManager 0000000077682620 6 bytes [49, C7, C2, 34, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverTransactionManager + 7 0000000077682627 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterProtocolAddressInformation 0000000077682630 6 bytes [49, C7, C2, 35, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterProtocolAddressInformation + 7 0000000077682637 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterThreadTerminatePort 0000000077682640 6 bytes [49, C7, C2, 36, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterThreadTerminatePort + 7 0000000077682647 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseKeyedEvent 0000000077682650 6 bytes [49, C7, C2, 37, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseKeyedEvent + 7 0000000077682657 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseWorkerFactoryWorker 0000000077682660 6 bytes [49, C7, C2, 38, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseWorkerFactoryWorker + 7 0000000077682667 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletionEx 0000000077682670 6 bytes [49, C7, C2, 39, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletionEx + 7 0000000077682677 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveProcessDebug 0000000077682680 6 bytes [49, C7, C2, 3A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveProcessDebug + 7 0000000077682687 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey 0000000077682690 6 bytes JMP 000000017508da70 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey + 7 0000000077682697 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRenameTransactionManager 00000000776826a0 6 bytes [49, C7, C2, 3C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRenameTransactionManager + 7 00000000776826a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplaceKey 00000000776826b0 6 bytes [49, C7, C2, 3D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplaceKey + 7 00000000776826b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplacePartitionUnit 00000000776826c0 6 bytes [49, C7, C2, 3E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplacePartitionUnit + 7 00000000776826c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReplyPort 00000000776826d0 6 bytes [49, C7, C2, 3F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReplyPort + 7 00000000776826d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRequestPort 00000000776826e0 6 bytes [49, C7, C2, 40, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRequestPort + 7 00000000776826e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResetEvent 00000000776826f0 6 bytes [49, C7, C2, 41, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResetEvent + 7 00000000776826f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResetWriteWatch 0000000077682700 6 bytes [49, C7, C2, 42, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResetWriteWatch + 7 0000000077682707 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRestoreKey 0000000077682710 6 bytes [49, C7, C2, 43, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRestoreKey + 7 0000000077682717 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000077682720 6 bytes [49, C7, C2, 44, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess + 7 0000000077682727 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackComplete 0000000077682730 6 bytes [49, C7, C2, 45, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackComplete + 7 0000000077682737 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackEnlistment 0000000077682740 6 bytes [49, C7, C2, 46, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackEnlistment + 7 0000000077682747 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackTransaction 0000000077682750 6 bytes [49, C7, C2, 47, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackTransaction + 7 0000000077682757 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollforwardTransactionManager 0000000077682760 6 bytes [49, C7, C2, 48, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtRollforwardTransactionManager + 7 0000000077682767 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKey 0000000077682770 1 byte JMP 0000000175098f00 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKey + 2 0000000077682772 4 bytes {JMP 0xfffffffffda16790} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKeyEx 0000000077682780 6 bytes [49, C7, C2, 4A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKeyEx + 7 0000000077682787 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSaveMergedKeys 0000000077682790 6 bytes [49, C7, C2, 4B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSaveMergedKeys + 7 0000000077682797 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSecureConnectPort 00000000776827a0 6 bytes JMP 00000001750881a0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSecureConnectPort + 7 00000000776827a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSerializeBoot 00000000776827b0 6 bytes [49, C7, C2, 4D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSerializeBoot + 7 00000000776827b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000776827c0 6 bytes [49, C7, C2, 4E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder + 7 00000000776827c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000776827d0 6 bytes [49, C7, C2, 4F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions + 7 00000000776827d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000776827e0 6 bytes [49, C7, C2, 50, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 7 00000000776827e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDebugFilterState 00000000776827f0 6 bytes [49, C7, C2, 51, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDebugFilterState + 7 00000000776827f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultHardErrorPort 0000000077682800 6 bytes [49, C7, C2, 52, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultHardErrorPort + 7 0000000077682807 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultLocale 0000000077682810 6 bytes [49, C7, C2, 53, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultLocale + 7 0000000077682817 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultUILanguage 0000000077682820 6 bytes [49, C7, C2, 54, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultUILanguage + 7 0000000077682827 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDriverEntryOrder 0000000077682830 6 bytes [49, C7, C2, 55, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetDriverEntryOrder + 7 0000000077682837 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetEaFile 0000000077682840 6 bytes [49, C7, C2, 56, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetEaFile + 7 0000000077682847 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighEventPair 0000000077682850 6 bytes [49, C7, C2, 57, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighEventPair + 7 0000000077682857 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighWaitLowEventPair 0000000077682860 6 bytes [49, C7, C2, 58, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighWaitLowEventPair + 7 0000000077682867 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationDebugObject 0000000077682870 6 bytes [49, C7, C2, 59, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationDebugObject + 7 0000000077682877 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationEnlistment 0000000077682880 6 bytes [49, C7, C2, 5A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationEnlistment + 7 0000000077682887 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationJobObject 0000000077682890 6 bytes JMP 00000001750a2d50 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationJobObject + 7 0000000077682897 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationKey 00000000776828a0 6 bytes [49, C7, C2, 5C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationKey + 7 00000000776828a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationResourceManager 00000000776828b0 6 bytes [49, C7, C2, 5D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationResourceManager + 7 00000000776828b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationToken 00000000776828c0 6 bytes JMP 000000017509f7d0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationToken + 7 00000000776828c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransaction 00000000776828d0 6 bytes [49, C7, C2, 5F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransaction + 7 00000000776828d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransactionManager 00000000776828e0 6 bytes [49, C7, C2, 60, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransactionManager + 7 00000000776828e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationWorkerFactory 00000000776828f0 6 bytes [49, C7, C2, 61, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationWorkerFactory + 7 00000000776828f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetIntervalProfile 0000000077682900 6 bytes [49, C7, C2, 62, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetIntervalProfile + 7 0000000077682907 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletion 0000000077682910 6 bytes [49, C7, C2, 63, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletion + 7 0000000077682917 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletionEx 0000000077682920 6 bytes [49, C7, C2, 64, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletionEx + 7 0000000077682927 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetLdtEntries 0000000077682930 6 bytes [49, C7, C2, 65, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetLdtEntries + 7 0000000077682937 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowEventPair 0000000077682940 6 bytes [49, C7, C2, 66, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowEventPair + 7 0000000077682947 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowWaitHighEventPair 0000000077682950 6 bytes [49, C7, C2, 67, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowWaitHighEventPair + 7 0000000077682957 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetQuotaInformationFile 0000000077682960 6 bytes [49, C7, C2, 68, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetQuotaInformationFile + 7 0000000077682967 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 0000000077682970 6 bytes JMP 000000017509f5d0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject + 7 0000000077682977 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValue 0000000077682980 6 bytes [49, C7, C2, 6A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValue + 7 0000000077682987 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValueEx 0000000077682990 6 bytes [49, C7, C2, 6B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValueEx + 7 0000000077682997 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000776829a0 6 bytes [49, C7, C2, 6C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 7 00000000776829a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000776829b0 6 bytes [49, C7, C2, 6D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState + 7 00000000776829b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemTime 00000000776829c0 6 bytes [49, C7, C2, 6E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemTime + 7 00000000776829c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetThreadExecutionState 00000000776829d0 6 bytes [49, C7, C2, 6F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetThreadExecutionState + 7 00000000776829d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerEx 00000000776829e0 6 bytes [49, C7, C2, 70, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerEx + 7 00000000776829e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerResolution 00000000776829f0 6 bytes [49, C7, C2, 71, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerResolution + 7 00000000776829f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetUuidSeed 0000000077682a00 6 bytes [49, C7, C2, 72, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetUuidSeed + 7 0000000077682a07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetVolumeInformationFile 0000000077682a10 6 bytes [49, C7, C2, 73, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSetVolumeInformationFile + 7 0000000077682a17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000077682a20 6 bytes [49, C7, C2, 74, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem + 7 0000000077682a27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownWorkerFactory 0000000077682a30 6 bytes [49, C7, C2, 75, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownWorkerFactory + 7 0000000077682a37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSignalAndWaitForSingleObject 0000000077682a40 6 bytes [49, C7, C2, 76, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSignalAndWaitForSingleObject + 7 0000000077682a47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSinglePhaseReject 0000000077682a50 6 bytes [49, C7, C2, 77, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSinglePhaseReject + 7 0000000077682a57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtStartProfile 0000000077682a60 6 bytes [49, C7, C2, 78, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtStartProfile + 7 0000000077682a67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtStopProfile 0000000077682a70 6 bytes [49, C7, C2, 79, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtStopProfile + 7 0000000077682a77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000077682a80 6 bytes [49, C7, C2, 7A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 7 0000000077682a87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000077682a90 6 bytes [49, C7, C2, 7B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 7 0000000077682a97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000077682aa0 6 bytes [49, C7, C2, 7C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 7 0000000077682aa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTestAlert 0000000077682ac0 6 bytes [49, C7, C2, 7E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTestAlert + 7 0000000077682ac7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtThawRegistry 0000000077682ad0 6 bytes [49, C7, C2, 7F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtThawRegistry + 7 0000000077682ad7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtThawTransactions 0000000077682ae0 6 bytes [49, C7, C2, 80, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtThawTransactions + 7 0000000077682ae7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTraceControl 0000000077682af0 6 bytes [49, C7, C2, 81, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTraceControl + 7 0000000077682af7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTranslateFilePath 0000000077682b00 6 bytes [49, C7, C2, 82, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtTranslateFilePath + 7 0000000077682b07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUmsThreadYield 0000000077682b10 6 bytes [49, C7, C2, 83, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUmsThreadYield + 7 0000000077682b17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadDriver 0000000077682b20 6 bytes [49, C7, C2, 84, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadDriver + 7 0000000077682b27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey 0000000077682b30 6 bytes [49, C7, C2, 85, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey + 7 0000000077682b37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey2 0000000077682b40 6 bytes [49, C7, C2, 86, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey2 + 7 0000000077682b47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKeyEx 0000000077682b50 6 bytes [49, C7, C2, 87, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKeyEx + 7 0000000077682b57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockFile 0000000077682b60 6 bytes [49, C7, C2, 88, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockFile + 7 0000000077682b67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockVirtualMemory 0000000077682b70 6 bytes [49, C7, C2, 89, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockVirtualMemory + 7 0000000077682b77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000077682b80 6 bytes [49, C7, C2, 8A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 7 0000000077682b87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForDebugEvent 0000000077682b90 6 bytes [49, C7, C2, 8B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForDebugEvent + 7 0000000077682b97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForKeyedEvent 0000000077682ba0 6 bytes [49, C7, C2, 8C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForKeyedEvent + 7 0000000077682ba7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForWorkViaWorkerFactory 0000000077682bb0 6 bytes [49, C7, C2, 8D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForWorkViaWorkerFactory + 7 0000000077682bb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitHighEventPair 0000000077682bc0 6 bytes [49, C7, C2, 8E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitHighEventPair + 7 0000000077682bc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitLowEventPair 0000000077682bd0 6 bytes [49, C7, C2, 8F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWaitLowEventPair + 7 0000000077682bd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWorkerFactoryWorkerReady 0000000077682be0 6 bytes [49, C7, C2, 90, 01, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!NtWorkerFactoryWorkerReady + 7 0000000077682be7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\ntdll.dll!RtlGetFullPathName_UEx 0000000077686940 5 bytes JMP 0000000175071680 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!CreateActCtxW 000000007752ace0 5 bytes JMP 00000001750a5d90 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007752e750 1 byte JMP 00000001750957e0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!CreateProcessInternalW + 2 000000007752e752 3 bytes {JMP 0xfffffffffdb67090} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!SetLocaleInfoA 000000007757f1b0 5 bytes JMP 00000001750a28a0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!AllocConsole 0000000077595a70 5 bytes JMP 0000000175084690 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW 000000007759f6c0 5 bytes JMP 0000000175067da0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!ReplaceFile 00000000775a43c0 5 bytes JMP 00000001750762e0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\kernel32.dll!WinExec 00000000775a8d50 5 bytes JMP 0000000175094790 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!OpenThreadToken + 1 000007fefd661961 8 bytes [B8, 08, 2C, AB, 00, 00, 00, ...] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!OpenThreadToken + 10 000007fefd66196a 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!GetTokenInformation + 1 000007fefd662e31 11 bytes {MOV EAX, 0xab28d0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!SetThreadToken + 1 000007fefd666d01 11 bytes {MOV EAX, 0xab2804; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!CreateFileMappingW + 1 000007fefd671921 11 bytes {MOV EAX, 0xab2aa8; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!GetFinalPathNameByHandleW + 1 000007fefd678c71 7 bytes [B8, 70, 5E, 07, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!GetFinalPathNameByHandleW + 10 000007fefd678c7a 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!AccessCheckByType 000007fefd67b330 12 bytes {MOV RAX, 0xab27cc; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\KERNELBASE.dll!DefineDosDeviceW + 1 000007fefd6a0c11 11 bytes {MOV EAX, 0x750a28a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!EnumDependentServicesW + 1 000007feff781461 11 bytes {MOV EAX, 0x75098820; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!QueryServiceStatusEx + 1 000007feff789415 11 bytes {MOV EAX, 0xab2400; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryW + 1 000007feff78aac1 11 bytes {MOV EAX, 0x7505a8e0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusExW 000007feff78eac0 12 bytes {MOV RAX, 0x7509d6a0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!ReportEventW 000007feff78fff0 12 bytes {MOV RAX, 0x750777f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!LookupAccountNameW + 1 000007feff790ac5 11 bytes {MOV EAX, 0x7505a7a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!RegisterEventSourceW 000007feff795fe0 12 bytes {MOV RAX, 0x75098d50; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!DeregisterEventSource + 1 000007feff79a541 5 bytes [B8, F0, 77, 07, 75] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!DeregisterEventSource + 9 000007feff79a549 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!RegQueryValueExW + 1 000007feff79f0d1 11 bytes {MOV EAX, 0xab2d1c; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!RegOpenKeyExW + 1 000007feff7a4e31 11 bytes {MOV EAX, 0xab2c64; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007feff7a55c8 11 bytes [48, B8, A0, D7, 09, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameW + 1 000007feff7a5721 11 bytes {MOV EAX, 0x7509be10; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameW + 1 000007feff7a57f1 11 bytes {MOV EAX, 0x7509bfe0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!RegisterEventSourceA 000007feff7a74e0 12 bytes {MOV RAX, 0x75098d80; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!QueryServiceObjectSecurity + 1 000007feff7bb3bd 11 bytes {MOV EAX, 0x7509a080; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!QueryServiceConfig2W + 1 000007feff7bb3f1 11 bytes {MOV EAX, 0x7509bb70; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!QueryServiceConfig2A + 1 000007feff7bb411 11 bytes {MOV EAX, 0x7509bc60; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007feff7bb85c 11 bytes [48, B8, B0, DA, 09, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW 000007feff7bb9d0 12 bytes {MOV RAX, 0x7509c2f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA 000007feff7bba3c 12 bytes {MOV RAX, 0x7509c5f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredRenameA + 1 000007feff7c2c71 5 bytes [B8, 30, 0A, 06, 75] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredRenameA + 9 000007feff7c2c79 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!GetEffectiveRightsFromAclW + 1 000007feff7c59e1 11 bytes {MOV EAX, 0x7505aa40; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!EnumDependentServicesA + 1 000007feff7cd091 11 bytes {MOV EAX, 0x75098820; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusExA 000007feff7cd200 12 bytes {MOV RAX, 0x7509d720; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusA 000007feff7cd400 12 bytes {MOV RAX, 0x7509d650; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusW 000007feff7cd800 12 bytes {MOV RAX, 0x7509d5f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!UnlockServiceDatabase + 1 000007feff7cd851 11 bytes {MOV EAX, 0x75098890; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!QueryServiceLockStatusW 000007feff7cd8c0 12 bytes {MOV RAX, 0x750987d0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!QueryServiceLockStatusA 000007feff7cd9d0 12 bytes {MOV RAX, 0x750987d0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!LockServiceDatabase + 1 000007feff7cdae1 8 bytes [B8, 50, 88, 09, 75, 00, 00, ...] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!LockServiceDatabase + 10 000007feff7cdaea 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameA + 1 000007feff7cdb61 7 bytes [B8, E0, BE, 09, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameA + 9 000007feff7cdb69 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameA + 1 000007feff7cdbf1 7 bytes [B8, 50, C1, 09, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameA + 9 000007feff7cdbf9 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredDeleteW + 1 000007feff7e0831 11 bytes {MOV EAX, 0x75060690; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredDeleteA + 1 000007feff7e08f1 11 bytes {MOV EAX, 0x75060af0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!ReportEventA + 1 000007feff7e1be1 11 bytes {MOV EAX, 0x750777f0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryA 000007feff7ec780 10 bytes [48, B8, A0, A8, 05, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryA + 11 000007feff7ec78b 1 byte {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredReadDomainCredentialsW + 1 000007feff7ed741 11 bytes {MOV EAX, 0x750604b0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredReadDomainCredentialsA + 1 000007feff7ed871 11 bytes {MOV EAX, 0x75060b90; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredWriteDomainCredentialsW + 1 000007feff7ed9a1 11 bytes {MOV EAX, 0x75060350; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredWriteDomainCredentialsA + 1 000007feff7eda81 11 bytes {MOV EAX, 0x75060a90; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredEnumerateW + 1 000007feff7edb81 11 bytes {MOV EAX, 0x75060700; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredEnumerateA + 1 000007feff7edcb1 11 bytes {MOV EAX, 0x75060c00; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredReadW + 1 000007feff7edde1 11 bytes {MOV EAX, 0x75060200; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredReadA + 1 000007feff7edef1 11 bytes {MOV EAX, 0x75060b20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredWriteW + 1 000007feff7ee001 11 bytes {MOV EAX, 0x75060130; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CredWriteA + 1 000007feff7ee0b1 11 bytes {MOV EAX, 0x75060a60; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\ADVAPI32.dll!CreateProcessWithTokenW 000007feff7f0ba0 12 bytes {MOV RAX, 0x75095da0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!ControlService 000007feff32642c 5 bytes JMP 000007feff7a5668 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW 000007feff326484 5 bytes JMP 000007feff78e810 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle 000007feff326518 5 bytes JMP 000007feff79adc4 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!OpenSCManagerW 000007feff32659c 5 bytes JMP 000007feff78e7f8 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!QueryServiceStatus 000007feff326730 5 bytes JMP 000007feff79615c .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!QueryServiceStatusEx 000007feff326784 5 bytes JMP 000007feff789414 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!StartServiceW 000007feff326824 5 bytes JMP 000007feff789400 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!SetServiceStatus 000007feff32687c 5 bytes JMP 000007feff788e34 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!OpenSCManagerA 000007feff326aa4 5 bytes JMP 000007feff79a320 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA 000007feff326c34 5 bytes JMP 000007feff79a30c .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!StartServiceA 000007feff326d00 5 bytes JMP 000007feff7bb320 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!QueryServiceObjectSecurity 000007feff326d58 5 bytes JMP 000007feff7bb3bc .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007feff326e00 5 bytes JMP 000007feff7bb32c .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007feff326f2c 5 bytes JMP 000007feff7bba3c .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007feff327220 5 bytes JMP 000007feff7bb9d0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007feff32739c 5 bytes JMP 000007feff7bbab4 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007feff327538 5 bytes JMP 000007feff7bbaa8 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007feff3275e8 5 bytes JMP 000007feff7bb85c .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007feff32790c 5 bytes JMP 000007feff7a55c8 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007feff327ab4 5 bytes JMP 000007feff7a5654 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfigA 000007feff327b04 5 bytes JMP 000007feff7bb3dc .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfigW 000007feff327c34 5 bytes JMP 000007feff78ec4c .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfig2A 000007feff327d78 5 bytes JMP 000007feff7bb410 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfig2W 000007feff328244 5 bytes JMP 000007feff7bb3f0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!StartServiceCtrlDispatcherA 000007feff3299e4 5 bytes JMP 000007feff7bb314 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!StartServiceCtrlDispatcherW 000007feff329ac8 5 bytes JMP 000007feff786e1c .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerW 000007feff32a51c 3 bytes JMP 000007feff782c18 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerW + 4 000007feff32a520 1 byte [00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerA 000007feff32a530 5 bytes JMP 000007feff7bb3b0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerExW 000007feff32a5b0 4 bytes JMP 000007feff788e00 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerExA 000007feff32a5c4 5 bytes JMP 000007feff7bb3a4 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!NotifyServiceStatusChange 000007feff32bb28 5 bytes JMP 000007feff78d9b0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\SYSTEM32\sechost.dll!NotifyServiceStatusChangeA 000007feff32bb3c 5 bytes JMP 000007feff7a74c0 .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\RPCRT4.dll!RpcBindingInqAuthClientExW + 1 000007feff535221 11 bytes {MOV EAX, 0x75096090; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\GDI32.dll!EnumFontFamiliesExW + 1 000007fefea18791 11 bytes {MOV EAX, 0x75077510; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\GDI32.dll!GdiAddFontResourceW 000007fefea1a104 12 bytes {MOV RAX, 0x75076d90; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\GDI32.dll!GdiDllInitialize + 1 000007fefea1aed1 11 bytes {MOV EAX, 0x75077260; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\GDI32.dll!RemoveFontResourceExW + 1 000007fefea24805 11 bytes {MOV EAX, 0x75076e30; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\GDI32.dll!GetFontResourceInfoW 000007fefea248c4 12 bytes {MOV RAX, 0x75076ed0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\GDI32.dll!EnumFontFamiliesExA + 1 000007fefea39085 11 bytes {MOV EAX, 0x750774a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\GDI32.dll!CreateScalableFontResourceW 000007fefea39ddc 12 bytes {MOV RAX, 0x75077000; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!WSASocketW + 1 000007fefe921bd1 11 bytes {MOV EAX, 0xab2be4; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!bind + 1 000007fefe921f01 11 bytes {MOV EAX, 0xab2b20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!connect 000007fefe9245c0 12 bytes {MOV RAX, 0x75092c80; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!listen + 1 000007fefe928291 11 bytes {MOV EAX, 0xab2b20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!gethostbyname 000007fefe928df0 7 bytes [48, B8, 60, 2B, AB, 00, 00] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!gethostbyname + 9 000007fefe928df9 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!gethostname + 1 000007fefe92ae21 10 bytes [B8, 2C, 2B, AB, 00, 00, 00, ...] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!WSANSPIoctl + 1 000007fefe9444c1 11 bytes {MOV EAX, 0x75092b50; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\WS2_32.dll!WSAConnect + 1 000007fefe94e0f1 11 bytes {MOV EAX, 0x75092cf0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\IMM32.DLL!ImmAssociateContext + 1 000007fefeb01751 11 bytes {MOV EAX, 0x750820b0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\IMM32.DLL!ImmAssociateContextEx + 1 000007fefeb08241 3 bytes [B8, 60, 21] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\IMM32.DLL!ImmAssociateContextEx + 5 000007fefeb08245 7 bytes [75, 00, 00, 00, 00, FF, E0] .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\sxs.dll!SxsInstallW + 1 000007fefd36ebe1 11 bytes {MOV EAX, 0x750a5660; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieRpcSs.exe[2004] C:\Windows\system32\SSPICLI.DLL!LsaRegisterLogonProcess 000007fefd239210 12 bytes {MOV RAX, 0x75092a30; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlAdjustPrivilege 000000007763a7d0 5 bytes JMP 000000010012215c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077653b10 5 bytes JMP 0000000175091f00 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077657ac0 5 bytes JMP 0000000175091e60 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk 000000007765c340 5 bytes JMP 00000000777e0008 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx 00000000776692d0 5 bytes JMP 00000001750945e0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlGetCurrentDirectory_U 000000007767b130 5 bytes JMP 0000000175071140 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlSetCurrentDirectory_U 000000007767b470 5 bytes JMP 00000001750713d0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!LdrQueryImageFileExecutionOptions 000000007767bb60 5 bytes JMP 0000000175091fc0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPagesScatter 00000000776812e0 4 bytes [49, C7, C2, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPagesScatter + 7 00000000776812e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForSingleObject 00000000776812f0 5 bytes [49, C7, C2, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForSingleObject + 7 00000000776812f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile 0000000077681310 5 bytes JMP 0000000175066e30 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 7 0000000077681317 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeviceIoControlFile 0000000077681320 5 bytes JMP 0000000175070360 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeviceIoControlFile + 7 0000000077681327 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077681330 5 bytes JMP 0000000175066f50 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 7 0000000077681337 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletion 0000000077681340 5 bytes [49, C7, C2, 06, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletion + 7 0000000077681347 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseSemaphore 0000000077681350 5 bytes [49, C7, C2, 07, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseSemaphore + 7 0000000077681357 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000077681360 5 bytes [49, C7, C2, 08, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort + 7 0000000077681367 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyPort 0000000077681370 5 bytes [49, C7, C2, 09, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyPort + 7 0000000077681377 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077681380 5 bytes [49, C7, C2, 0A, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 7 0000000077681387 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetEvent 0000000077681390 5 bytes [49, C7, C2, 0B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetEvent + 7 0000000077681397 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000776813a0 5 bytes JMP 00000001750735d0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 7 00000000776813a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000776813b0 5 bytes JMP 0000000175093b20 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject + 7 00000000776813b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationFile 00000000776813c0 5 bytes JMP 0000000175075ae0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationFile + 7 00000000776813c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey 00000000776813d0 5 bytes JMP 0000000175090b00 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 7 00000000776813d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateValueKey 00000000776813e0 5 bytes JMP 0000000175090620 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateValueKey + 7 00000000776813e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFindAtom 00000000776813f0 5 bytes [49, C7, C2, 11, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFindAtom + 7 00000000776813f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultLocale 0000000077681400 5 bytes [49, C7, C2, 12, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultLocale + 7 0000000077681407 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryKey 0000000077681410 5 bytes JMP 0000000175090fb0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryKey + 7 0000000077681417 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryValueKey 0000000077681420 5 bytes JMP 0000000175090270 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryValueKey + 7 0000000077681427 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077681430 5 bytes [49, C7, C2, 15, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory + 7 0000000077681437 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationProcess 0000000077681440 5 bytes [49, C7, C2, 16, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationProcess + 7 0000000077681447 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects32 0000000077681450 5 bytes [49, C7, C2, 17, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects32 + 7 0000000077681457 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFileGather 0000000077681460 5 bytes [49, C7, C2, 18, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFileGather + 7 0000000077681467 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077681470 5 bytes JMP 00000001750952e0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 7 0000000077681477 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey 0000000077681480 5 bytes JMP 000000017508f8f0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 7 0000000077681487 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077681490 5 bytes [49, C7, C2, 1B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory + 7 0000000077681497 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 00000000776814a0 5 bytes JMP 0000000175086860 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 7 00000000776814a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseMutant 00000000776814b0 5 bytes [49, C7, C2, 1D, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseMutant + 7 00000000776814b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationToken 00000000776814c0 5 bytes [49, C7, C2, 1E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationToken + 7 00000000776814c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRequestWaitReplyPort 00000000776814d0 5 bytes JMP 0000000175086f00 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRequestWaitReplyPort + 7 00000000776814d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVirtualMemory 00000000776814e0 5 bytes JMP 0000000175093db0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVirtualMemory + 7 00000000776814e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000776814f0 5 bytes [49, C7, C2, 21, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 7 00000000776814f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077681500 5 bytes [49, C7, C2, 22, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread + 7 0000000077681507 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077681510 5 bytes JMP 00000001750a0040 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 7 0000000077681517 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000077681520 5 bytes JMP 0000000175075fc0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 7 0000000077681527 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckAndAuditAlarm 0000000077681540 5 bytes [49, C7, C2, 26, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckAndAuditAlarm + 7 0000000077681547 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077681550 5 bytes [49, C7, C2, 27, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 7 0000000077681557 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000077681560 5 bytes [49, C7, C2, 28, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx + 7 0000000077681567 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetEventBoostPriority 0000000077681580 5 bytes [49, C7, C2, 2A, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetEventBoostPriority + 7 0000000077681587 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadFileScatter 0000000077681590 5 bytes [49, C7, C2, 2B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadFileScatter + 7 0000000077681597 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000776815a0 5 bytes [49, C7, C2, 2C, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 7 00000000776815a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000776815b0 5 bytes [49, C7, C2, 2D, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 7 00000000776815b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPerformanceCounter 00000000776815c0 5 bytes [49, C7, C2, 2E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPerformanceCounter + 7 00000000776815c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateKey 00000000776815d0 5 bytes JMP 000000017508fda0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateKey + 7 00000000776815d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000776815e0 5 bytes JMP 00000001750763c0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 7 00000000776815e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDelayExecution 00000000776815f0 5 bytes [49, C7, C2, 31, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDelayExecution + 7 00000000776815f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077681600 1 byte JMP 0000000175070590 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 2 0000000077681602 3 bytes {JMP 0xfffffffffd9eef90} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformation 0000000077681610 5 bytes JMP 00000001750a2be0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformation + 7 0000000077681617 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077681620 5 bytes JMP 0000000175089e60 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 7 0000000077681627 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimer 0000000077681630 5 bytes [49, C7, C2, 35, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimer + 7 0000000077681637 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFsControlFile 0000000077681640 5 bytes JMP 0000000175073370 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFsControlFile + 7 0000000077681647 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077681650 5 bytes [49, C7, C2, 37, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 7 0000000077681657 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCloseObjectAuditAlarm 0000000077681660 5 bytes [49, C7, C2, 38, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCloseObjectAuditAlarm + 7 0000000077681667 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077681670 5 bytes JMP 00000001750a0120 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 7 0000000077681677 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000077681680 5 bytes JMP 00000001750723b0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 7 0000000077681687 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtClearEvent 0000000077681690 5 bytes [49, C7, C2, 3B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtClearEvent + 7 0000000077681697 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadVirtualMemory 00000000776816a0 5 bytes [49, C7, C2, 3C, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadVirtualMemory + 7 00000000776816a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000776816b0 5 bytes JMP 00000001750891f0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent + 7 00000000776816b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00000000776816c0 5 bytes JMP 000000017509f800 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken + 7 00000000776816c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateToken 00000000776816d0 5 bytes [49, C7, C2, 3F, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateToken + 7 00000000776816d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultUILanguage 00000000776816f0 5 bytes [49, C7, C2, 41, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultUILanguage + 7 00000000776816f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077681700 5 bytes [49, C7, C2, 42, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 7 0000000077681707 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtYieldExecution 0000000077681710 5 bytes [49, C7, C2, 43, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtYieldExecution + 7 0000000077681717 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAddAtom 0000000077681720 5 bytes [49, C7, C2, 44, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAddAtom + 7 0000000077681727 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000077681730 5 bytes JMP 0000000175088fa0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 7 0000000077681737 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVolumeInformationFile 0000000077681740 5 bytes JMP 0000000175073840 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVolumeInformationFile + 7 0000000077681747 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077681750 5 bytes JMP 0000000175089b60 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 7 0000000077681757 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushBuffersFile 0000000077681760 5 bytes [49, C7, C2, 48, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushBuffersFile + 7 0000000077681767 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtApphelpCacheControl 0000000077681770 5 bytes [49, C7, C2, 49, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtApphelpCacheControl + 7 0000000077681777 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077681780 5 bytes [49, C7, C2, 4A, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 7 0000000077681787 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077681790 5 bytes [49, C7, C2, 4B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 7 0000000077681797 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtIsProcessInJob 00000000776817a0 5 bytes [49, C7, C2, 4C, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtIsProcessInJob + 7 00000000776817a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000776817b0 5 bytes [49, C7, C2, 4D, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 7 00000000776817b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySection 00000000776817c0 5 bytes [49, C7, C2, 4E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySection + 7 00000000776817c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000776817d0 5 bytes [49, C7, C2, 4F, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 7 00000000776817d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadRequestData 00000000776817f0 5 bytes [49, C7, C2, 51, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadRequestData + 7 00000000776817f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077681800 5 bytes JMP 0000000175074240 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 7 0000000077681807 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEvent 0000000077681810 5 bytes [49, C7, C2, 53, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEvent + 7 0000000077681817 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteRequestData 0000000077681820 5 bytes [49, C7, C2, 54, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteRequestData + 7 0000000077681827 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenDirectoryObject 0000000077681830 5 bytes [49, C7, C2, 55, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenDirectoryObject + 7 0000000077681837 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeAndAuditAlarm 0000000077681840 5 bytes [49, C7, C2, 56, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeAndAuditAlarm + 7 0000000077681847 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects 0000000077681860 5 bytes [49, C7, C2, 58, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects + 7 0000000077681867 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationObject 0000000077681870 5 bytes [49, C7, C2, 59, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationObject + 7 0000000077681877 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFile 0000000077681880 5 bytes [49, C7, C2, 5A, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFile + 7 0000000077681887 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTraceEvent 0000000077681890 5 bytes JMP 00000001750a28c0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTraceEvent + 7 0000000077681897 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPowerInformation 00000000776818a0 5 bytes [49, C7, C2, 5C, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPowerInformation + 7 00000000776818a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000776818b0 5 bytes JMP 000000017508e580 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 7 00000000776818b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelTimer 00000000776818c0 5 bytes [49, C7, C2, 5E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelTimer + 7 00000000776818c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimer 00000000776818d0 5 bytes [49, C7, C2, 5F, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimer + 7 00000000776818d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAcceptConnectPort 00000000776818e0 5 bytes [49, C7, C2, 60, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAcceptConnectPort + 7 00000000776818e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheck 00000000776818f0 5 bytes [49, C7, C2, 61, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheck + 7 00000000776818f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077681900 5 bytes [49, C7, C2, 62, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType + 7 0000000077681907 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultList 0000000077681910 5 bytes [49, C7, C2, 63, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultList + 7 0000000077681917 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm 0000000077681920 5 bytes [49, C7, C2, 64, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm + 7 0000000077681927 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0000000077681930 5 bytes [49, C7, C2, 65, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle + 7 0000000077681937 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000077681940 5 bytes [49, C7, C2, 66, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 7 0000000077681947 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAddDriverEntry 0000000077681950 5 bytes [49, C7, C2, 67, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAddDriverEntry + 7 0000000077681957 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustGroupsToken 0000000077681960 5 bytes [49, C7, C2, 68, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustGroupsToken + 7 0000000077681967 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlertResumeThread 0000000077681970 5 bytes [49, C7, C2, 69, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlertResumeThread + 7 0000000077681977 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlertThread 0000000077681980 5 bytes [49, C7, C2, 6A, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlertThread + 7 0000000077681987 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateLocallyUniqueId 0000000077681990 5 bytes [49, C7, C2, 6B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateLocallyUniqueId + 7 0000000077681997 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateReserveObject 00000000776819a0 5 bytes [49, C7, C2, 6C, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateReserveObject + 7 00000000776819a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUserPhysicalPages 00000000776819b0 5 bytes [49, C7, C2, 6D, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUserPhysicalPages + 7 00000000776819b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUuids 00000000776819c0 5 bytes [49, C7, C2, 6E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUuids + 7 00000000776819c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcAcceptConnectPort 00000000776819d0 5 bytes [49, C7, C2, 6F, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcAcceptConnectPort + 7 00000000776819d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCancelMessage 00000000776819e0 5 bytes [49, C7, C2, 70, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCancelMessage + 7 00000000776819e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00000000776819f0 5 bytes JMP 00000001750886d0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort + 7 00000000776819f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 0000000077681a00 5 bytes JMP 0000000175088520 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort + 7 0000000077681a07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePortSection 0000000077681a10 5 bytes [49, C7, C2, 73, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePortSection + 7 0000000077681a17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateResourceReserve 0000000077681a20 5 bytes [49, C7, C2, 74, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateResourceReserve + 7 0000000077681a27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSectionView 0000000077681a30 5 bytes [49, C7, C2, 75, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSectionView + 7 0000000077681a37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSecurityContext 0000000077681a40 5 bytes [49, C7, C2, 76, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSecurityContext + 7 0000000077681a47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeletePortSection 0000000077681a50 5 bytes [49, C7, C2, 77, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeletePortSection + 7 0000000077681a57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteResourceReserve 0000000077681a60 5 bytes [49, C7, C2, 78, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteResourceReserve + 7 0000000077681a67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSectionView 0000000077681a70 5 bytes [49, C7, C2, 79, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSectionView + 7 0000000077681a77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSecurityContext 0000000077681a80 5 bytes [49, C7, C2, 7A, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSecurityContext + 7 0000000077681a87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDisconnectPort 0000000077681a90 5 bytes [49, C7, C2, 7B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDisconnectPort + 7 0000000077681a97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077681aa0 5 bytes JMP 0000000175086890 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort + 7 0000000077681aa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderProcess 0000000077681ab0 5 bytes [49, C7, C2, 7D, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderProcess + 7 0000000077681ab7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderThread 0000000077681ac0 5 bytes [49, C7, C2, 7E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderThread + 7 0000000077681ac7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformation 0000000077681ad0 5 bytes JMP 0000000175086520 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformation + 7 0000000077681ad7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformationMessage 0000000077681ae0 5 bytes JMP 0000000175086550 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformationMessage + 7 0000000077681ae7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcRevokeSecurityContext 0000000077681af0 5 bytes [49, C7, C2, 81, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcRevokeSecurityContext + 7 0000000077681af7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000077681b00 5 bytes JMP 0000000175087100 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort + 7 0000000077681b07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSetInformation 0000000077681b10 5 bytes [49, C7, C2, 83, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSetInformation + 7 0000000077681b17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAreMappedFilesTheSame 0000000077681b20 5 bytes [49, C7, C2, 84, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAreMappedFilesTheSame + 7 0000000077681b27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000077681b30 5 bytes JMP 00000001750a2d00 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject + 7 0000000077681b37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFileEx 0000000077681b40 5 bytes [49, C7, C2, 86, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFileEx + 7 0000000077681b47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelSynchronousIoFile 0000000077681b50 5 bytes [49, C7, C2, 87, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCancelSynchronousIoFile + 7 0000000077681b57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCommitComplete 0000000077681b60 5 bytes [49, C7, C2, 88, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCommitComplete + 7 0000000077681b67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCommitEnlistment 0000000077681b70 5 bytes [49, C7, C2, 89, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCommitEnlistment + 7 0000000077681b77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCommitTransaction 0000000077681b80 5 bytes [49, C7, C2, 8A, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCommitTransaction + 7 0000000077681b87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompactKeys 0000000077681b90 5 bytes [49, C7, C2, 8B, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompactKeys + 7 0000000077681b97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompareTokens 0000000077681ba0 5 bytes [49, C7, C2, 8C, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompareTokens + 7 0000000077681ba7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompleteConnectPort 0000000077681bb0 5 bytes [49, C7, C2, 8D, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompleteConnectPort + 7 0000000077681bb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompressKey 0000000077681bc0 5 bytes [49, C7, C2, 8E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCompressKey + 7 0000000077681bc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 0000000077681bd0 5 bytes JMP 0000000175087f10 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort + 7 0000000077681bd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDebugObject 0000000077681be0 5 bytes [49, C7, C2, 90, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDebugObject + 7 0000000077681be7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDirectoryObject 0000000077681bf0 5 bytes [49, C7, C2, 91, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDirectoryObject + 7 0000000077681bf7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEnlistment 0000000077681c00 5 bytes [49, C7, C2, 92, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEnlistment + 7 0000000077681c07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000077681c10 5 bytes [49, C7, C2, 93, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair + 7 0000000077681c17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000077681c20 5 bytes [49, C7, C2, 94, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion + 7 0000000077681c27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobObject 0000000077681c30 5 bytes JMP 00000001750a29d0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobObject + 7 0000000077681c37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobSet 0000000077681c40 5 bytes [49, C7, C2, 96, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobSet + 7 0000000077681c47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyTransacted 0000000077681c50 5 bytes [49, C7, C2, 97, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyTransacted + 7 0000000077681c57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyedEvent 0000000077681c60 5 bytes [49, C7, C2, 98, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyedEvent + 7 0000000077681c67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMailslotFile 0000000077681c70 5 bytes JMP 000000017506fcc0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMailslotFile + 7 0000000077681c77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000077681c80 5 bytes JMP 00000001750893a0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 7 0000000077681c87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateNamedPipeFile 0000000077681c90 5 bytes JMP 000000017506fef0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateNamedPipeFile + 7 0000000077681c97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePagingFile 0000000077681ca0 5 bytes [49, C7, C2, 9C, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePagingFile + 7 0000000077681ca7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 0000000077681cb0 5 bytes JMP 0000000175087d10 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort + 7 0000000077681cb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePrivateNamespace 0000000077681cc0 5 bytes [49, C7, C2, 9E, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePrivateNamespace + 7 0000000077681cc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess 0000000077681cd0 5 bytes [49, C7, C2, 9F, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 7 0000000077681cd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfile 0000000077681ce0 5 bytes [49, C7, C2, A0, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfile + 7 0000000077681ce7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfileEx 0000000077681cf0 5 bytes [49, C7, C2, A1, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfileEx + 7 0000000077681cf7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateResourceManager 0000000077681d00 5 bytes [49, C7, C2, A2, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateResourceManager + 7 0000000077681d07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000077681d10 5 bytes JMP 0000000175089760 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore + 7 0000000077681d17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 0000000077681d20 5 bytes [49, C7, C2, A4, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject + 7 0000000077681d27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077681d30 5 bytes [49, C7, C2, A5, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 7 0000000077681d37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000077681d40 5 bytes [49, C7, C2, A6, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 7 0000000077681d47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateToken 0000000077681d50 5 bytes [49, C7, C2, A7, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateToken + 7 0000000077681d57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransaction 0000000077681d60 5 bytes [49, C7, C2, A8, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransaction + 7 0000000077681d67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransactionManager 0000000077681d70 5 bytes [49, C7, C2, A9, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransactionManager + 7 0000000077681d77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess 0000000077681d80 5 bytes [49, C7, C2, AA, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 7 0000000077681d87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWaitablePort 0000000077681d90 5 bytes [49, C7, C2, AB, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWaitablePort + 7 0000000077681d97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWorkerFactory 0000000077681da0 5 bytes [49, C7, C2, AC, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWorkerFactory + 7 0000000077681da7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000077681db0 5 bytes [49, C7, C2, AD, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess + 7 0000000077681db7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDebugContinue 0000000077681dc0 5 bytes [49, C7, C2, AE, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDebugContinue + 7 0000000077681dc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteAtom 0000000077681dd0 5 bytes [49, C7, C2, AF, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteAtom + 7 0000000077681dd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000077681de0 5 bytes [49, C7, C2, B0, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry + 7 0000000077681de7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteDriverEntry 0000000077681df0 5 bytes [49, C7, C2, B1, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteDriverEntry + 7 0000000077681df7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile 0000000077681e00 1 byte JMP 000000017506a190 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 2 0000000077681e02 3 bytes {JMP 0xfffffffffd9e8390} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey 0000000077681e10 5 bytes JMP 0000000175090fd0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 7 0000000077681e17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteObjectAuditAlarm 0000000077681e20 5 bytes [49, C7, C2, B4, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteObjectAuditAlarm + 7 0000000077681e27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeletePrivateNamespace 0000000077681e30 5 bytes [49, C7, C2, B5, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeletePrivateNamespace + 7 0000000077681e37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077681e40 5 bytes JMP 0000000175090e20 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 7 0000000077681e47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDisableLastKnownGood 0000000077681e50 5 bytes [49, C7, C2, B7, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDisableLastKnownGood + 7 0000000077681e57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDisplayString 0000000077681e60 3 bytes [49, C7, C2] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDisplayString + 4 0000000077681e64 1 byte [00] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDrawText 0000000077681e70 5 bytes [49, C7, C2, B9, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDrawText + 7 0000000077681e77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnableLastKnownGood 0000000077681e80 5 bytes [49, C7, C2, BA, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnableLastKnownGood + 7 0000000077681e87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateBootEntries 0000000077681e90 5 bytes [49, C7, C2, BB, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateBootEntries + 7 0000000077681e97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateDriverEntries 0000000077681ea0 5 bytes [49, C7, C2, BC, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateDriverEntries + 7 0000000077681ea7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateSystemEnvironmentValuesEx 0000000077681eb0 5 bytes [49, C7, C2, BD, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateSystemEnvironmentValuesEx + 7 0000000077681eb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateTransactionObject 0000000077681ec0 5 bytes [49, C7, C2, BE, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateTransactionObject + 7 0000000077681ec7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtExtendSection 0000000077681ed0 5 bytes [49, C7, C2, BF, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtExtendSection + 7 0000000077681ed7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFilterToken 0000000077681ee0 5 bytes [49, C7, C2, C0, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFilterToken + 7 0000000077681ee7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstallUILanguage 0000000077681ef0 5 bytes [49, C7, C2, C1, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstallUILanguage + 7 0000000077681ef7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstructionCache 0000000077681f00 5 bytes [49, C7, C2, C2, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstructionCache + 7 0000000077681f07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushKey 0000000077681f10 5 bytes [49, C7, C2, C3, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushKey + 7 0000000077681f17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushProcessWriteBuffers 0000000077681f20 5 bytes [49, C7, C2, C4, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushProcessWriteBuffers + 7 0000000077681f27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushVirtualMemory 0000000077681f30 5 bytes [49, C7, C2, C5, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushVirtualMemory + 7 0000000077681f37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushWriteBuffer 0000000077681f40 5 bytes [49, C7, C2, C6, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFlushWriteBuffer + 7 0000000077681f47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreeUserPhysicalPages 0000000077681f50 5 bytes [49, C7, C2, C7, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreeUserPhysicalPages + 7 0000000077681f57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeRegistry 0000000077681f60 5 bytes [49, C7, C2, C8, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeRegistry + 7 0000000077681f67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeTransactions 0000000077681f70 5 bytes [49, C7, C2, C9, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeTransactions + 7 0000000077681f77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077681f80 5 bytes [49, C7, C2, CA, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread + 7 0000000077681f87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetCurrentProcessorNumber 0000000077681f90 5 bytes [49, C7, C2, CB, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetCurrentProcessorNumber + 7 0000000077681f97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetDevicePowerState 0000000077681fa0 5 bytes [49, C7, C2, CC, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetDevicePowerState + 7 0000000077681fa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetMUIRegistryInfo 0000000077681fb0 5 bytes [49, C7, C2, CD, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetMUIRegistryInfo + 7 0000000077681fb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextProcess 0000000077681fc0 5 bytes [49, C7, C2, CE, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextProcess + 7 0000000077681fc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextThread 0000000077681fd0 5 bytes [49, C7, C2, CF, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextThread + 7 0000000077681fd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNlsSectionPtr 0000000077681fe0 5 bytes [49, C7, C2, D0, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNlsSectionPtr + 7 0000000077681fe7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNotificationResourceManager 0000000077681ff0 5 bytes [49, C7, C2, D1, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetNotificationResourceManager + 7 0000000077681ff7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetPlugPlayEvent 0000000077682000 5 bytes [49, C7, C2, D2, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetPlugPlayEvent + 7 0000000077682007 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetWriteWatch 0000000077682010 5 bytes [49, C7, C2, D3, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtGetWriteWatch + 7 0000000077682017 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateAnonymousToken 0000000077682020 5 bytes JMP 00000001750868c0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateAnonymousToken + 7 0000000077682027 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateThread 0000000077682030 5 bytes JMP 0000000175086910 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateThread + 7 0000000077682037 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeNlsFiles 0000000077682040 5 bytes [49, C7, C2, D6, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeNlsFiles + 7 0000000077682047 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeRegistry 0000000077682050 5 bytes [49, C7, C2, D7, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeRegistry + 7 0000000077682057 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtInitiatePowerAction 0000000077682060 5 bytes [49, C7, C2, D8, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtInitiatePowerAction + 7 0000000077682067 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtIsSystemResumeAutomatic 0000000077682070 5 bytes [49, C7, C2, D9, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtIsSystemResumeAutomatic + 7 0000000077682077 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtIsUILanguageComitted 0000000077682080 5 bytes [49, C7, C2, DA, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtIsUILanguageComitted + 7 0000000077682087 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtListenPort 0000000077682090 5 bytes [49, C7, C2, DB, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtListenPort + 7 0000000077682097 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000776820a0 5 bytes JMP 00000001750922e0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 7 00000000776820a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey 00000000776820b0 5 bytes JMP 000000017508dac0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey + 7 00000000776820b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey2 00000000776820c0 5 bytes [49, C7, C2, DE, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey2 + 7 00000000776820c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKeyEx 00000000776820d0 5 bytes [49, C7, C2, DF, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKeyEx + 7 00000000776820d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockFile 00000000776820e0 5 bytes [49, C7, C2, E0, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockFile + 7 00000000776820e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockProductActivationKeys 00000000776820f0 5 bytes [49, C7, C2, E1, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockProductActivationKeys + 7 00000000776820f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockRegistryKey 0000000077682100 5 bytes [49, C7, C2, E2, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockRegistryKey + 7 0000000077682107 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockVirtualMemory 0000000077682110 5 bytes [49, C7, C2, E3, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLockVirtualMemory + 7 0000000077682117 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMakePermanentObject 0000000077682120 5 bytes [49, C7, C2, E4, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMakePermanentObject + 7 0000000077682127 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 0000000077682130 5 bytes [49, C7, C2, E5, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject + 7 0000000077682137 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapCMFModule 0000000077682140 5 bytes [49, C7, C2, E6, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapCMFModule + 7 0000000077682147 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPages 0000000077682150 5 bytes [49, C7, C2, E7, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPages + 7 0000000077682157 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000077682160 5 bytes [49, C7, C2, E8, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 7 0000000077682167 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtModifyDriverEntry 0000000077682170 5 bytes [49, C7, C2, E9, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtModifyDriverEntry + 7 0000000077682177 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeDirectoryFile 0000000077682180 5 bytes [49, C7, C2, EA, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeDirectoryFile + 7 0000000077682187 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000077682190 5 bytes JMP 000000017508e750 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey + 7 0000000077682197 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000776821a0 5 bytes JMP 000000017508d520 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys + 7 00000000776821a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeSession 00000000776821b0 5 bytes [49, C7, C2, ED, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeSession + 7 00000000776821b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEnlistment 00000000776821c0 5 bytes [49, C7, C2, EE, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEnlistment + 7 00000000776821c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000776821d0 5 bytes [49, C7, C2, EF, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair + 7 00000000776821d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000776821e0 5 bytes [49, C7, C2, F0, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion + 7 00000000776821e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenJobObject 00000000776821f0 5 bytes [49, C7, C2, F1, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenJobObject + 7 00000000776821f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx 0000000077682200 5 bytes JMP 000000017508f8c0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 7 0000000077682207 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransacted 0000000077682210 5 bytes [49, C7, C2, F3, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransacted + 7 0000000077682217 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransactedEx 0000000077682220 5 bytes [49, C7, C2, F4, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransactedEx + 7 0000000077682227 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyedEvent 0000000077682230 5 bytes [49, C7, C2, F5, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyedEvent + 7 0000000077682237 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000077682240 5 bytes JMP 00000001750895b0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant + 7 0000000077682247 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenObjectAuditAlarm 0000000077682250 5 bytes [49, C7, C2, F7, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenObjectAuditAlarm + 7 0000000077682257 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenPrivateNamespace 0000000077682260 5 bytes [49, C7, C2, F8, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenPrivateNamespace + 7 0000000077682267 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000077682270 5 bytes [49, C7, C2, F9, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 7 0000000077682277 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenResourceManager 0000000077682280 5 bytes [49, C7, C2, FA, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenResourceManager + 7 0000000077682287 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000077682290 5 bytes JMP 00000001750899b0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore + 7 0000000077682297 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSession 00000000776822a0 5 bytes [49, C7, C2, FC, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSession + 7 00000000776822a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSymbolicLinkObject 00000000776822b0 5 bytes [49, C7, C2, FD, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSymbolicLinkObject + 7 00000000776822b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000776822c0 2 bytes JMP 000000017509f420 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 3 00000000776822c3 2 bytes [A1, FD] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000776822d0 5 bytes [49, C7, C2, FF, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer + 7 00000000776822d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransaction 00000000776822e0 6 bytes [49, C7, C2, 00, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransaction + 7 00000000776822e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransactionManager 00000000776822f0 4 bytes [49, C7, C2, 01] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransactionManager + 5 00000000776822f5 1 byte [00] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPlugPlayControl 0000000077682300 6 bytes [49, C7, C2, 02, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPlugPlayControl + 7 0000000077682307 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareComplete 0000000077682310 6 bytes [49, C7, C2, 03, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareComplete + 7 0000000077682317 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareEnlistment 0000000077682320 6 bytes [49, C7, C2, 04, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareEnlistment + 7 0000000077682327 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareComplete 0000000077682330 6 bytes [49, C7, C2, 05, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareComplete + 7 0000000077682337 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareEnlistment 0000000077682340 6 bytes [49, C7, C2, 06, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareEnlistment + 7 0000000077682347 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeCheck 0000000077682350 6 bytes [49, C7, C2, 07, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeCheck + 7 0000000077682357 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeObjectAuditAlarm 0000000077682360 6 bytes [49, C7, C2, 08, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeObjectAuditAlarm + 7 0000000077682367 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegedServiceAuditAlarm 0000000077682370 6 bytes [49, C7, C2, 09, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegedServiceAuditAlarm + 7 0000000077682377 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationComplete 0000000077682380 6 bytes [49, C7, C2, 0A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationComplete + 7 0000000077682387 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationFailed 0000000077682390 6 bytes [49, C7, C2, 0B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationFailed + 7 0000000077682397 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPulseEvent 00000000776823a0 6 bytes [49, C7, C2, 0C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtPulseEvent + 7 00000000776823a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootEntryOrder 00000000776823b0 6 bytes [49, C7, C2, 0D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootEntryOrder + 7 00000000776823b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootOptions 00000000776823c0 6 bytes [49, C7, C2, 0E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootOptions + 7 00000000776823c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDebugFilterState 00000000776823d0 6 bytes [49, C7, C2, 0F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDebugFilterState + 7 00000000776823d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryObject 00000000776823e0 6 bytes [49, C7, C2, 10, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryObject + 7 00000000776823e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDriverEntryOrder 00000000776823f0 6 bytes [49, C7, C2, 11, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDriverEntryOrder + 7 00000000776823f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEaFile 0000000077682400 6 bytes [49, C7, C2, 12, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEaFile + 7 0000000077682407 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000077682410 6 bytes JMP 0000000175072400 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 7 0000000077682417 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationAtom 0000000077682420 6 bytes [49, C7, C2, 14, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationAtom + 7 0000000077682427 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationEnlistment 0000000077682430 6 bytes [49, C7, C2, 15, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationEnlistment + 7 0000000077682437 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationJobObject 0000000077682440 6 bytes [49, C7, C2, 16, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationJobObject + 7 0000000077682447 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationPort 0000000077682450 6 bytes [49, C7, C2, 17, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationPort + 7 0000000077682457 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationResourceManager 0000000077682460 6 bytes [49, C7, C2, 18, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationResourceManager + 7 0000000077682467 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransaction 0000000077682470 6 bytes [49, C7, C2, 19, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransaction + 7 0000000077682477 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransactionManager 0000000077682480 6 bytes [49, C7, C2, 1A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransactionManager + 7 0000000077682487 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationWorkerFactory 0000000077682490 6 bytes [49, C7, C2, 1B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationWorkerFactory + 7 0000000077682497 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInstallUILanguage 00000000776824a0 6 bytes [49, C7, C2, 1C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInstallUILanguage + 7 00000000776824a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIntervalProfile 00000000776824b0 6 bytes [49, C7, C2, 1D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIntervalProfile + 7 00000000776824b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIoCompletion 00000000776824c0 6 bytes [49, C7, C2, 1E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIoCompletion + 7 00000000776824c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryLicenseValue 00000000776824d0 6 bytes [49, C7, C2, 1F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryLicenseValue + 7 00000000776824d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMultipleValueKey 00000000776824e0 6 bytes JMP 0000000175090830 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMultipleValueKey + 7 00000000776824e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMutant 00000000776824f0 6 bytes [49, C7, C2, 21, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMutant + 7 00000000776824f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeys 0000000077682500 6 bytes [49, C7, C2, 22, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeys + 7 0000000077682507 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeysEx 0000000077682510 6 bytes [49, C7, C2, 23, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeysEx + 7 0000000077682517 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPortInformationProcess 0000000077682520 6 bytes [49, C7, C2, 24, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPortInformationProcess + 7 0000000077682527 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryQuotaInformationFile 0000000077682530 6 bytes [49, C7, C2, 25, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryQuotaInformationFile + 7 0000000077682537 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityAttributesToken 0000000077682540 6 bytes [49, C7, C2, 26, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityAttributesToken + 7 0000000077682547 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityObject 0000000077682550 6 bytes JMP 000000017509f4a0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityObject + 7 0000000077682557 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySemaphore 0000000077682560 6 bytes [49, C7, C2, 28, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySemaphore + 7 0000000077682567 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySymbolicLinkObject 0000000077682570 6 bytes [49, C7, C2, 29, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySymbolicLinkObject + 7 0000000077682577 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValue 0000000077682580 6 bytes [49, C7, C2, 2A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValue + 7 0000000077682587 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValueEx 0000000077682590 6 bytes [49, C7, C2, 2B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValueEx + 7 0000000077682597 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformationEx 00000000776825a0 6 bytes [49, C7, C2, 2C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformationEx + 7 00000000776825a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimerResolution 00000000776825b0 6 bytes [49, C7, C2, 2D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimerResolution + 7 00000000776825b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000776825c0 6 bytes [49, C7, C2, 2E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx + 7 00000000776825c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError 00000000776825e0 6 bytes [49, C7, C2, 30, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 7 00000000776825e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadOnlyEnlistment 00000000776825f0 6 bytes [49, C7, C2, 31, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadOnlyEnlistment + 7 00000000776825f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverEnlistment 0000000077682600 6 bytes [49, C7, C2, 32, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverEnlistment + 7 0000000077682607 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverResourceManager 0000000077682610 6 bytes [49, C7, C2, 33, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverResourceManager + 7 0000000077682617 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverTransactionManager 0000000077682620 6 bytes [49, C7, C2, 34, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverTransactionManager + 7 0000000077682627 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterProtocolAddressInformation 0000000077682630 6 bytes [49, C7, C2, 35, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterProtocolAddressInformation + 7 0000000077682637 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterThreadTerminatePort 0000000077682640 6 bytes [49, C7, C2, 36, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterThreadTerminatePort + 7 0000000077682647 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseKeyedEvent 0000000077682650 6 bytes [49, C7, C2, 37, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseKeyedEvent + 7 0000000077682657 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseWorkerFactoryWorker 0000000077682660 6 bytes [49, C7, C2, 38, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseWorkerFactoryWorker + 7 0000000077682667 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletionEx 0000000077682670 6 bytes [49, C7, C2, 39, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletionEx + 7 0000000077682677 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveProcessDebug 0000000077682680 6 bytes [49, C7, C2, 3A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveProcessDebug + 7 0000000077682687 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey 0000000077682690 6 bytes JMP 000000017508da70 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey + 7 0000000077682697 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRenameTransactionManager 00000000776826a0 6 bytes [49, C7, C2, 3C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRenameTransactionManager + 7 00000000776826a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplaceKey 00000000776826b0 6 bytes [49, C7, C2, 3D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplaceKey + 7 00000000776826b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplacePartitionUnit 00000000776826c0 6 bytes [49, C7, C2, 3E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplacePartitionUnit + 7 00000000776826c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReplyPort 00000000776826d0 6 bytes [49, C7, C2, 3F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReplyPort + 7 00000000776826d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRequestPort 00000000776826e0 6 bytes [49, C7, C2, 40, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRequestPort + 7 00000000776826e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResetEvent 00000000776826f0 6 bytes [49, C7, C2, 41, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResetEvent + 7 00000000776826f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResetWriteWatch 0000000077682700 6 bytes [49, C7, C2, 42, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResetWriteWatch + 7 0000000077682707 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRestoreKey 0000000077682710 6 bytes [49, C7, C2, 43, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRestoreKey + 7 0000000077682717 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000077682720 6 bytes [49, C7, C2, 44, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess + 7 0000000077682727 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackComplete 0000000077682730 6 bytes [49, C7, C2, 45, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackComplete + 7 0000000077682737 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackEnlistment 0000000077682740 6 bytes [49, C7, C2, 46, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackEnlistment + 7 0000000077682747 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackTransaction 0000000077682750 6 bytes [49, C7, C2, 47, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackTransaction + 7 0000000077682757 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollforwardTransactionManager 0000000077682760 6 bytes [49, C7, C2, 48, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtRollforwardTransactionManager + 7 0000000077682767 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKey 0000000077682770 1 byte JMP 0000000175098f00 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKey + 2 0000000077682772 4 bytes {JMP 0xfffffffffda16790} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKeyEx 0000000077682780 6 bytes [49, C7, C2, 4A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKeyEx + 7 0000000077682787 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSaveMergedKeys 0000000077682790 6 bytes [49, C7, C2, 4B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSaveMergedKeys + 7 0000000077682797 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSecureConnectPort 00000000776827a0 6 bytes JMP 00000001750881a0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSecureConnectPort + 7 00000000776827a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSerializeBoot 00000000776827b0 6 bytes [49, C7, C2, 4D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSerializeBoot + 7 00000000776827b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000776827c0 6 bytes [49, C7, C2, 4E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder + 7 00000000776827c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000776827d0 6 bytes [49, C7, C2, 4F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions + 7 00000000776827d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000776827e0 6 bytes [49, C7, C2, 50, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 7 00000000776827e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDebugFilterState 00000000776827f0 6 bytes [49, C7, C2, 51, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDebugFilterState + 7 00000000776827f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultHardErrorPort 0000000077682800 6 bytes [49, C7, C2, 52, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultHardErrorPort + 7 0000000077682807 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultLocale 0000000077682810 6 bytes [49, C7, C2, 53, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultLocale + 7 0000000077682817 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultUILanguage 0000000077682820 6 bytes [49, C7, C2, 54, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultUILanguage + 7 0000000077682827 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDriverEntryOrder 0000000077682830 6 bytes [49, C7, C2, 55, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetDriverEntryOrder + 7 0000000077682837 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetEaFile 0000000077682840 6 bytes [49, C7, C2, 56, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetEaFile + 7 0000000077682847 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighEventPair 0000000077682850 6 bytes [49, C7, C2, 57, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighEventPair + 7 0000000077682857 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighWaitLowEventPair 0000000077682860 6 bytes [49, C7, C2, 58, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighWaitLowEventPair + 7 0000000077682867 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationDebugObject 0000000077682870 6 bytes [49, C7, C2, 59, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationDebugObject + 7 0000000077682877 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationEnlistment 0000000077682880 6 bytes [49, C7, C2, 5A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationEnlistment + 7 0000000077682887 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationJobObject 0000000077682890 6 bytes JMP 00000001750a2d50 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationJobObject + 7 0000000077682897 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationKey 00000000776828a0 6 bytes [49, C7, C2, 5C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationKey + 7 00000000776828a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationResourceManager 00000000776828b0 6 bytes [49, C7, C2, 5D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationResourceManager + 7 00000000776828b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationToken 00000000776828c0 6 bytes JMP 000000017509f7d0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationToken + 7 00000000776828c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransaction 00000000776828d0 6 bytes [49, C7, C2, 5F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransaction + 7 00000000776828d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransactionManager 00000000776828e0 6 bytes [49, C7, C2, 60, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransactionManager + 7 00000000776828e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationWorkerFactory 00000000776828f0 6 bytes [49, C7, C2, 61, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationWorkerFactory + 7 00000000776828f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetIntervalProfile 0000000077682900 6 bytes [49, C7, C2, 62, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetIntervalProfile + 7 0000000077682907 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletion 0000000077682910 6 bytes [49, C7, C2, 63, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletion + 7 0000000077682917 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletionEx 0000000077682920 6 bytes [49, C7, C2, 64, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletionEx + 7 0000000077682927 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetLdtEntries 0000000077682930 6 bytes [49, C7, C2, 65, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetLdtEntries + 7 0000000077682937 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowEventPair 0000000077682940 6 bytes [49, C7, C2, 66, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowEventPair + 7 0000000077682947 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowWaitHighEventPair 0000000077682950 6 bytes [49, C7, C2, 67, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowWaitHighEventPair + 7 0000000077682957 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetQuotaInformationFile 0000000077682960 6 bytes [49, C7, C2, 68, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetQuotaInformationFile + 7 0000000077682967 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 0000000077682970 6 bytes JMP 000000017509f5d0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject + 7 0000000077682977 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValue 0000000077682980 6 bytes [49, C7, C2, 6A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValue + 7 0000000077682987 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValueEx 0000000077682990 6 bytes [49, C7, C2, 6B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValueEx + 7 0000000077682997 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000776829a0 6 bytes [49, C7, C2, 6C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 7 00000000776829a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000776829b0 6 bytes [49, C7, C2, 6D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState + 7 00000000776829b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemTime 00000000776829c0 6 bytes [49, C7, C2, 6E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemTime + 7 00000000776829c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetThreadExecutionState 00000000776829d0 6 bytes [49, C7, C2, 6F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetThreadExecutionState + 7 00000000776829d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerEx 00000000776829e0 6 bytes [49, C7, C2, 70, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerEx + 7 00000000776829e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerResolution 00000000776829f0 6 bytes [49, C7, C2, 71, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerResolution + 7 00000000776829f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetUuidSeed 0000000077682a00 6 bytes [49, C7, C2, 72, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetUuidSeed + 7 0000000077682a07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetVolumeInformationFile 0000000077682a10 6 bytes [49, C7, C2, 73, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetVolumeInformationFile + 7 0000000077682a17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000077682a20 6 bytes [49, C7, C2, 74, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem + 7 0000000077682a27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownWorkerFactory 0000000077682a30 6 bytes [49, C7, C2, 75, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownWorkerFactory + 7 0000000077682a37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSignalAndWaitForSingleObject 0000000077682a40 6 bytes [49, C7, C2, 76, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSignalAndWaitForSingleObject + 7 0000000077682a47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSinglePhaseReject 0000000077682a50 6 bytes [49, C7, C2, 77, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSinglePhaseReject + 7 0000000077682a57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtStartProfile 0000000077682a60 6 bytes [49, C7, C2, 78, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtStartProfile + 7 0000000077682a67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtStopProfile 0000000077682a70 6 bytes [49, C7, C2, 79, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtStopProfile + 7 0000000077682a77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000077682a80 6 bytes [49, C7, C2, 7A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 7 0000000077682a87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000077682a90 6 bytes [49, C7, C2, 7B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 7 0000000077682a97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000077682aa0 6 bytes [49, C7, C2, 7C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 7 0000000077682aa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTestAlert 0000000077682ac0 6 bytes [49, C7, C2, 7E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTestAlert + 7 0000000077682ac7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtThawRegistry 0000000077682ad0 6 bytes [49, C7, C2, 7F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtThawRegistry + 7 0000000077682ad7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtThawTransactions 0000000077682ae0 6 bytes [49, C7, C2, 80, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtThawTransactions + 7 0000000077682ae7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTraceControl 0000000077682af0 6 bytes [49, C7, C2, 81, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTraceControl + 7 0000000077682af7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTranslateFilePath 0000000077682b00 6 bytes [49, C7, C2, 82, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTranslateFilePath + 7 0000000077682b07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUmsThreadYield 0000000077682b10 6 bytes [49, C7, C2, 83, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUmsThreadYield + 7 0000000077682b17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadDriver 0000000077682b20 6 bytes [49, C7, C2, 84, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadDriver + 7 0000000077682b27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey 0000000077682b30 6 bytes [49, C7, C2, 85, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey + 7 0000000077682b37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey2 0000000077682b40 6 bytes [49, C7, C2, 86, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey2 + 7 0000000077682b47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKeyEx 0000000077682b50 6 bytes [49, C7, C2, 87, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKeyEx + 7 0000000077682b57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockFile 0000000077682b60 6 bytes [49, C7, C2, 88, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockFile + 7 0000000077682b67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockVirtualMemory 0000000077682b70 6 bytes [49, C7, C2, 89, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockVirtualMemory + 7 0000000077682b77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000077682b80 6 bytes [49, C7, C2, 8A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 7 0000000077682b87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForDebugEvent 0000000077682b90 6 bytes [49, C7, C2, 8B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForDebugEvent + 7 0000000077682b97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForKeyedEvent 0000000077682ba0 6 bytes [49, C7, C2, 8C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForKeyedEvent + 7 0000000077682ba7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForWorkViaWorkerFactory 0000000077682bb0 6 bytes [49, C7, C2, 8D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForWorkViaWorkerFactory + 7 0000000077682bb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitHighEventPair 0000000077682bc0 6 bytes [49, C7, C2, 8E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitHighEventPair + 7 0000000077682bc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitLowEventPair 0000000077682bd0 6 bytes [49, C7, C2, 8F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWaitLowEventPair + 7 0000000077682bd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWorkerFactoryWorkerReady 0000000077682be0 6 bytes [49, C7, C2, 90, 01, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWorkerFactoryWorkerReady + 7 0000000077682be7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlGetFullPathName_UEx 0000000077686940 5 bytes JMP 0000000175071680 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!CreateActCtxW 000000007752ace0 5 bytes JMP 00000001750a5d90 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007752e750 1 byte JMP 00000001750957e0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!CreateProcessInternalW + 2 000000007752e752 3 bytes {JMP 0xfffffffffdb67090} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!SetLocaleInfoA 000000007757f1b0 5 bytes JMP 00000001750a28a0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!AllocConsole 0000000077595a70 5 bytes JMP 0000000175084690 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW 000000007759f6c0 5 bytes JMP 0000000175067da0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!ReplaceFile 00000000775a43c0 5 bytes JMP 00000001750762e0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\kernel32.dll!WinExec 00000000775a8d50 5 bytes JMP 0000000175094790 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!GetTokenInformation + 1 000007fefd662e31 11 bytes {MOV EAX, 0x12228c; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!SetThreadToken + 1 000007fefd666d01 11 bytes {MOV EAX, 0x1221c0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!CreateFileMappingW + 1 000007fefd671921 2 bytes [B8, 64] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!CreateFileMappingW + 4 000007fefd671924 8 bytes {ADC AL, [RAX]; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!GetFinalPathNameByHandleW + 1 000007fefd678c71 7 bytes [B8, 70, 5E, 07, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!GetFinalPathNameByHandleW + 10 000007fefd678c7a 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!AccessCheckByType 000007fefd67b330 12 bytes {MOV RAX, 0x122188; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\KERNELBASE.dll!DefineDosDeviceW + 1 000007fefd6a0c11 11 bytes {MOV EAX, 0x750a28a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!EnumDependentServicesW + 1 000007feff781461 11 bytes {MOV EAX, 0x75098820; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!QueryServiceStatusEx + 1 000007feff789415 11 bytes {MOV EAX, 0x121e10; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryW + 1 000007feff78aac1 11 bytes {MOV EAX, 0x7505a8e0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusExW 000007feff78eac0 12 bytes {MOV RAX, 0x7509d6a0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!ReportEventW 000007feff78fff0 12 bytes {MOV RAX, 0x750777f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!LookupAccountNameW + 1 000007feff790ac5 11 bytes {MOV EAX, 0x7505a7a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!RegisterEventSourceW 000007feff795fe0 12 bytes {MOV RAX, 0x75098d50; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!DeregisterEventSource + 1 000007feff79a541 5 bytes [B8, F0, 77, 07, 75] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!DeregisterEventSource + 9 000007feff79a549 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007feff7a55c8 11 bytes [48, B8, A0, D7, 09, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameW + 1 000007feff7a5721 11 bytes {MOV EAX, 0x7509be10; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameW + 1 000007feff7a57f1 11 bytes {MOV EAX, 0x7509bfe0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!RegisterEventSourceA 000007feff7a74e0 12 bytes {MOV RAX, 0x75098d80; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!QueryServiceObjectSecurity + 1 000007feff7bb3bd 11 bytes {MOV EAX, 0x7509a080; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!QueryServiceConfig2W + 1 000007feff7bb3f1 11 bytes {MOV EAX, 0x7509bb70; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!QueryServiceConfig2A + 1 000007feff7bb411 11 bytes {MOV EAX, 0x7509bc60; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007feff7bb85c 11 bytes [48, B8, B0, DA, 09, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW 000007feff7bb9d0 12 bytes {MOV RAX, 0x7509c2f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA 000007feff7bba3c 12 bytes {MOV RAX, 0x7509c5f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredRenameA + 1 000007feff7c2c71 5 bytes [B8, 30, 0A, 06, 75] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredRenameA + 9 000007feff7c2c79 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!GetEffectiveRightsFromAclW + 1 000007feff7c59e1 11 bytes {MOV EAX, 0x7505aa40; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!EnumDependentServicesA + 1 000007feff7cd091 11 bytes {MOV EAX, 0x75098820; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusExA 000007feff7cd200 12 bytes {MOV RAX, 0x7509d720; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusA 000007feff7cd400 12 bytes {MOV RAX, 0x7509d650; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusW 000007feff7cd800 12 bytes {MOV RAX, 0x7509d5f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!UnlockServiceDatabase + 1 000007feff7cd851 11 bytes {MOV EAX, 0x75098890; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!QueryServiceLockStatusW 000007feff7cd8c0 12 bytes {MOV RAX, 0x750987d0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!QueryServiceLockStatusA 000007feff7cd9d0 12 bytes {MOV RAX, 0x750987d0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!LockServiceDatabase + 1 000007feff7cdae1 8 bytes [B8, 50, 88, 09, 75, 00, 00, ...] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!LockServiceDatabase + 10 000007feff7cdaea 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameA + 1 000007feff7cdb61 7 bytes [B8, E0, BE, 09, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameA + 9 000007feff7cdb69 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameA + 1 000007feff7cdbf1 7 bytes [B8, 50, C1, 09, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameA + 9 000007feff7cdbf9 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredDeleteW + 1 000007feff7e0831 11 bytes {MOV EAX, 0x75060690; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredDeleteA + 1 000007feff7e08f1 11 bytes {MOV EAX, 0x75060af0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!ReportEventA + 1 000007feff7e1be1 11 bytes {MOV EAX, 0x750777f0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryA 000007feff7ec780 10 bytes [48, B8, A0, A8, 05, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryA + 11 000007feff7ec78b 1 byte {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredReadDomainCredentialsW + 1 000007feff7ed741 11 bytes {MOV EAX, 0x750604b0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredReadDomainCredentialsA + 1 000007feff7ed871 11 bytes {MOV EAX, 0x75060b90; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredWriteDomainCredentialsW + 1 000007feff7ed9a1 11 bytes {MOV EAX, 0x75060350; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredWriteDomainCredentialsA + 1 000007feff7eda81 11 bytes {MOV EAX, 0x75060a90; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredEnumerateW + 1 000007feff7edb81 11 bytes {MOV EAX, 0x75060700; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredEnumerateA + 1 000007feff7edcb1 11 bytes {MOV EAX, 0x75060c00; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredReadW + 1 000007feff7edde1 11 bytes {MOV EAX, 0x75060200; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredReadA + 1 000007feff7edef1 11 bytes {MOV EAX, 0x75060b20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredWriteW + 1 000007feff7ee001 11 bytes {MOV EAX, 0x75060130; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CredWriteA + 1 000007feff7ee0b1 11 bytes {MOV EAX, 0x75060a60; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\ADVAPI32.dll!CreateProcessWithTokenW 000007feff7f0ba0 12 bytes {MOV RAX, 0x75095da0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ControlService 000007feff32642c 5 bytes JMP 000007feff7a5668 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW 000007feff326484 5 bytes JMP 000007feff78e810 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle 000007feff326518 5 bytes JMP 000007feff79adc4 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!OpenSCManagerW 000007feff32659c 5 bytes JMP 000007feff78e7f8 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!QueryServiceStatus 000007feff326730 5 bytes JMP 000007feff79615c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!QueryServiceStatusEx 000007feff326784 5 bytes JMP 000007feff789414 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!StartServiceW 000007feff326824 5 bytes JMP 000007feff789400 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!SetServiceStatus 000007feff32687c 5 bytes JMP 000007feff788e34 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!OpenSCManagerA 000007feff326aa4 5 bytes JMP 000007feff79a320 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA 000007feff326c34 5 bytes JMP 000007feff79a30c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!StartServiceA 000007feff326d00 5 bytes JMP 000007feff7bb320 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!QueryServiceObjectSecurity 000007feff326d58 5 bytes JMP 000007feff7bb3bc .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007feff326e00 5 bytes JMP 000007feff7bb32c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007feff326f2c 5 bytes JMP 000007feff7bba3c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007feff327220 5 bytes JMP 000007feff7bb9d0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007feff32739c 5 bytes JMP 000007feff7bbab4 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007feff327538 5 bytes JMP 000007feff7bbaa8 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007feff3275e8 5 bytes JMP 000007feff7bb85c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007feff32790c 5 bytes JMP 000007feff7a55c8 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007feff327ab4 5 bytes JMP 000007feff7a5654 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfigA 000007feff327b04 5 bytes JMP 000007feff7bb3dc .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfigW 000007feff327c34 5 bytes JMP 000007feff78ec4c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfig2A 000007feff327d78 5 bytes JMP 000007feff7bb410 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfig2W 000007feff328244 5 bytes JMP 000007feff7bb3f0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!StartServiceCtrlDispatcherA 000007feff3299e4 5 bytes JMP 000007feff7bb314 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!StartServiceCtrlDispatcherW 000007feff329ac8 5 bytes JMP 000007feff786e1c .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerW 000007feff32a51c 3 bytes JMP 000007feff782c18 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerW + 4 000007feff32a520 1 byte [00] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerA 000007feff32a530 5 bytes JMP 000007feff7bb3b0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerExW 000007feff32a5b0 4 bytes JMP 000007feff788e00 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerExA 000007feff32a5c4 5 bytes JMP 000007feff7bb3a4 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!NotifyServiceStatusChange 000007feff32bb28 5 bytes JMP 000007feff78d9b0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\SYSTEM32\sechost.dll!NotifyServiceStatusChangeA 000007feff32bb3c 5 bytes JMP 000007feff7a74c0 .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\RPCRT4.dll!RpcBindingInqAuthClientExW + 1 000007feff535221 11 bytes {MOV EAX, 0x75096090; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\GDI32.dll!EnumFontFamiliesExW + 1 000007fefea18791 11 bytes {MOV EAX, 0x75077510; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\GDI32.dll!GdiAddFontResourceW 000007fefea1a104 12 bytes {MOV RAX, 0x75076d90; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\GDI32.dll!GdiDllInitialize + 1 000007fefea1aed1 11 bytes {MOV EAX, 0x75077260; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\GDI32.dll!RemoveFontResourceExW + 1 000007fefea24805 11 bytes {MOV EAX, 0x75076e30; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\GDI32.dll!GetFontResourceInfoW 000007fefea248c4 12 bytes {MOV RAX, 0x75076ed0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\GDI32.dll!EnumFontFamiliesExA + 1 000007fefea39085 11 bytes {MOV EAX, 0x750774a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\GDI32.dll!CreateScalableFontResourceW 000007fefea39ddc 12 bytes {MOV RAX, 0x75077000; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\IMM32.DLL!ImmAssociateContext + 1 000007fefeb01751 11 bytes {MOV EAX, 0x750820b0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\IMM32.DLL!ImmAssociateContextEx + 1 000007fefeb08241 3 bytes [B8, 60, 21] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\IMM32.DLL!ImmAssociateContextEx + 5 000007fefeb08245 7 bytes [75, 00, 00, 00, 00, FF, E0] .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\SspiCli.dll!LsaRegisterLogonProcess 000007fefd239210 12 bytes {MOV RAX, 0x75092a30; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\WTSAPI32.dll!WTSEnumerateSessionsW + 1 000007fefb541431 11 bytes {MOV EAX, 0x750a8330; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\WTSAPI32.dll!WTSQueryUserToken + 1 000007fefb5418f1 11 bytes {MOV EAX, 0x750a81e0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\WTSAPI32.dll!WTSRegisterSessionNotification + 1 000007fefb541d01 11 bytes {MOV EAX, 0x750777f0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\WTSAPI32.dll!WTSUnRegisterSessionNotification 000007fefb541e30 12 bytes {MOV RAX, 0x750777f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\WTSAPI32.dll!WTSRegisterSessionNotificationEx + 1 000007fefb545031 11 bytes {MOV EAX, 0x750777f0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\WTSAPI32.dll!WTSUnRegisterSessionNotificationEx + 1 000007fefb5450b5 11 bytes {MOV EAX, 0x750777f0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe[2444] C:\Windows\system32\WTSAPI32.dll!WTSEnumerateProcessesW + 1 000007fefb5454b1 11 bytes {MOV EAX, 0x750a8470; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077653b10 5 bytes JMP 0000000175091f00 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077657ac0 5 bytes JMP 0000000175091e60 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk 000000007765c340 5 bytes JMP 00000000777e0008 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx 00000000776692d0 5 bytes JMP 00000001750945e0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!RtlGetCurrentDirectory_U 000000007767b130 5 bytes JMP 0000000175071140 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!RtlSetCurrentDirectory_U 000000007767b470 5 bytes JMP 00000001750713d0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!LdrQueryImageFileExecutionOptions 000000007767bb60 5 bytes JMP 0000000175091fc0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPagesScatter 00000000776812e0 4 bytes [49, C7, C2, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPagesScatter + 7 00000000776812e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForSingleObject 00000000776812f0 5 bytes [49, C7, C2, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForSingleObject + 7 00000000776812f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile 0000000077681310 5 bytes JMP 0000000175066e30 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 7 0000000077681317 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeviceIoControlFile 0000000077681320 5 bytes JMP 0000000175070360 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeviceIoControlFile + 7 0000000077681327 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile 0000000077681330 5 bytes JMP 0000000175066f50 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 7 0000000077681337 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletion 0000000077681340 5 bytes [49, C7, C2, 06, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletion + 7 0000000077681347 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseSemaphore 0000000077681350 5 bytes [49, C7, C2, 07, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseSemaphore + 7 0000000077681357 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000077681360 5 bytes [49, C7, C2, 08, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort + 7 0000000077681367 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyPort 0000000077681370 5 bytes [49, C7, C2, 09, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyPort + 7 0000000077681377 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077681380 5 bytes [49, C7, C2, 0A, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 7 0000000077681387 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetEvent 0000000077681390 5 bytes [49, C7, C2, 0B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetEvent + 7 0000000077681397 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00000000776813a0 5 bytes JMP 00000001750735d0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 7 00000000776813a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000776813b0 5 bytes JMP 0000000175093b20 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject + 7 00000000776813b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationFile 00000000776813c0 5 bytes JMP 0000000175075ae0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationFile + 7 00000000776813c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey 00000000776813d0 5 bytes JMP 0000000175090b00 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 7 00000000776813d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateValueKey 00000000776813e0 5 bytes JMP 0000000175090620 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateValueKey + 7 00000000776813e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFindAtom 00000000776813f0 5 bytes [49, C7, C2, 11, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFindAtom + 7 00000000776813f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultLocale 0000000077681400 5 bytes [49, C7, C2, 12, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultLocale + 7 0000000077681407 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryKey 0000000077681410 5 bytes JMP 0000000175090fb0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryKey + 7 0000000077681417 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryValueKey 0000000077681420 5 bytes JMP 0000000175090270 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryValueKey + 7 0000000077681427 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077681430 5 bytes [49, C7, C2, 15, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory + 7 0000000077681437 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationProcess 0000000077681440 5 bytes [49, C7, C2, 16, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationProcess + 7 0000000077681447 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects32 0000000077681450 5 bytes [49, C7, C2, 17, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects32 + 7 0000000077681457 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFileGather 0000000077681460 5 bytes [49, C7, C2, 18, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFileGather + 7 0000000077681467 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077681470 5 bytes JMP 00000001750952e0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 7 0000000077681477 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey 0000000077681480 5 bytes JMP 000000017508f8f0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 7 0000000077681487 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077681490 5 bytes [49, C7, C2, 1B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory + 7 0000000077681497 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 00000000776814a0 5 bytes JMP 0000000175086860 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 7 00000000776814a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseMutant 00000000776814b0 5 bytes [49, C7, C2, 1D, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseMutant + 7 00000000776814b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationToken 00000000776814c0 5 bytes [49, C7, C2, 1E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationToken + 7 00000000776814c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRequestWaitReplyPort 00000000776814d0 5 bytes JMP 0000000175086f00 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRequestWaitReplyPort + 7 00000000776814d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVirtualMemory 00000000776814e0 5 bytes JMP 0000000175093db0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVirtualMemory + 7 00000000776814e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000776814f0 5 bytes [49, C7, C2, 21, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 7 00000000776814f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077681500 5 bytes [49, C7, C2, 22, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread + 7 0000000077681507 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077681510 5 bytes JMP 00000001750a0040 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 7 0000000077681517 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000077681520 5 bytes JMP 0000000175075fc0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 7 0000000077681527 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckAndAuditAlarm 0000000077681540 5 bytes [49, C7, C2, 26, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckAndAuditAlarm + 7 0000000077681547 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000077681550 5 bytes [49, C7, C2, 27, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 7 0000000077681557 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000077681560 5 bytes [49, C7, C2, 28, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx + 7 0000000077681567 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetEventBoostPriority 0000000077681580 5 bytes [49, C7, C2, 2A, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetEventBoostPriority + 7 0000000077681587 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadFileScatter 0000000077681590 5 bytes [49, C7, C2, 2B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadFileScatter + 7 0000000077681597 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000776815a0 5 bytes [49, C7, C2, 2C, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 7 00000000776815a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000776815b0 5 bytes [49, C7, C2, 2D, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 7 00000000776815b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPerformanceCounter 00000000776815c0 5 bytes [49, C7, C2, 2E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPerformanceCounter + 7 00000000776815c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateKey 00000000776815d0 5 bytes JMP 000000017508fda0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateKey + 7 00000000776815d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000776815e0 5 bytes JMP 00000001750763c0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 7 00000000776815e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDelayExecution 00000000776815f0 5 bytes [49, C7, C2, 31, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDelayExecution + 7 00000000776815f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077681600 1 byte JMP 0000000175070590 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 2 0000000077681602 3 bytes {JMP 0xfffffffffd9eef90} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformation 0000000077681610 5 bytes JMP 00000001750a2be0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformation + 7 0000000077681617 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000077681620 5 bytes JMP 0000000175089e60 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 7 0000000077681627 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimer 0000000077681630 5 bytes [49, C7, C2, 35, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimer + 7 0000000077681637 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFsControlFile 0000000077681640 5 bytes JMP 0000000175073370 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFsControlFile + 7 0000000077681647 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077681650 5 bytes [49, C7, C2, 37, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 7 0000000077681657 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCloseObjectAuditAlarm 0000000077681660 5 bytes [49, C7, C2, 38, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCloseObjectAuditAlarm + 7 0000000077681667 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000077681670 5 bytes JMP 00000001750a0120 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 7 0000000077681677 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000077681680 5 bytes JMP 00000001750723b0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 7 0000000077681687 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtClearEvent 0000000077681690 5 bytes [49, C7, C2, 3B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtClearEvent + 7 0000000077681697 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadVirtualMemory 00000000776816a0 5 bytes [49, C7, C2, 3C, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadVirtualMemory + 7 00000000776816a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000776816b0 5 bytes JMP 00000001750891f0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent + 7 00000000776816b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00000000776816c0 5 bytes JMP 000000017509f800 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken + 7 00000000776816c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateToken 00000000776816d0 5 bytes [49, C7, C2, 3F, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateToken + 7 00000000776816d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultUILanguage 00000000776816f0 5 bytes [49, C7, C2, 41, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDefaultUILanguage + 7 00000000776816f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077681700 5 bytes [49, C7, C2, 42, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 7 0000000077681707 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtYieldExecution 0000000077681710 5 bytes [49, C7, C2, 43, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtYieldExecution + 7 0000000077681717 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAddAtom 0000000077681720 5 bytes [49, C7, C2, 44, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAddAtom + 7 0000000077681727 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000077681730 5 bytes JMP 0000000175088fa0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 7 0000000077681737 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVolumeInformationFile 0000000077681740 5 bytes JMP 0000000175073840 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryVolumeInformationFile + 7 0000000077681747 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000077681750 5 bytes JMP 0000000175089b60 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 7 0000000077681757 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushBuffersFile 0000000077681760 5 bytes [49, C7, C2, 48, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushBuffersFile + 7 0000000077681767 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtApphelpCacheControl 0000000077681770 5 bytes [49, C7, C2, 49, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtApphelpCacheControl + 7 0000000077681777 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx 0000000077681780 5 bytes [49, C7, C2, 4A, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 7 0000000077681787 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000077681790 5 bytes [49, C7, C2, 4B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 7 0000000077681797 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtIsProcessInJob 00000000776817a0 5 bytes [49, C7, C2, 4C, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtIsProcessInJob + 7 00000000776817a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000776817b0 5 bytes [49, C7, C2, 4D, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 7 00000000776817b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySection 00000000776817c0 5 bytes [49, C7, C2, 4E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySection + 7 00000000776817c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000776817d0 5 bytes [49, C7, C2, 4F, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 7 00000000776817d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadRequestData 00000000776817f0 5 bytes [49, C7, C2, 51, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadRequestData + 7 00000000776817f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077681800 5 bytes JMP 0000000175074240 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 7 0000000077681807 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEvent 0000000077681810 5 bytes [49, C7, C2, 53, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEvent + 7 0000000077681817 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteRequestData 0000000077681820 5 bytes [49, C7, C2, 54, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWriteRequestData + 7 0000000077681827 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenDirectoryObject 0000000077681830 5 bytes [49, C7, C2, 55, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenDirectoryObject + 7 0000000077681837 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeAndAuditAlarm 0000000077681840 5 bytes [49, C7, C2, 56, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeAndAuditAlarm + 7 0000000077681847 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects 0000000077681860 5 bytes [49, C7, C2, 58, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForMultipleObjects + 7 0000000077681867 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationObject 0000000077681870 5 bytes [49, C7, C2, 59, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationObject + 7 0000000077681877 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFile 0000000077681880 5 bytes [49, C7, C2, 5A, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFile + 7 0000000077681887 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTraceEvent 0000000077681890 5 bytes JMP 00000001750a28c0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTraceEvent + 7 0000000077681897 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPowerInformation 00000000776818a0 5 bytes [49, C7, C2, 5C, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPowerInformation + 7 00000000776818a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000776818b0 5 bytes JMP 000000017508e580 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 7 00000000776818b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelTimer 00000000776818c0 5 bytes [49, C7, C2, 5E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelTimer + 7 00000000776818c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimer 00000000776818d0 5 bytes [49, C7, C2, 5F, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimer + 7 00000000776818d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAcceptConnectPort 00000000776818e0 5 bytes [49, C7, C2, 60, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAcceptConnectPort + 7 00000000776818e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheck 00000000776818f0 5 bytes [49, C7, C2, 61, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheck + 7 00000000776818f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077681900 5 bytes [49, C7, C2, 62, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType + 7 0000000077681907 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultList 0000000077681910 5 bytes [49, C7, C2, 63, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultList + 7 0000000077681917 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm 0000000077681920 5 bytes [49, C7, C2, 64, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm + 7 0000000077681927 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0000000077681930 5 bytes [49, C7, C2, 65, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle + 7 0000000077681937 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000077681940 5 bytes [49, C7, C2, 66, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry + 7 0000000077681947 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAddDriverEntry 0000000077681950 5 bytes [49, C7, C2, 67, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAddDriverEntry + 7 0000000077681957 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustGroupsToken 0000000077681960 5 bytes [49, C7, C2, 68, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustGroupsToken + 7 0000000077681967 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlertResumeThread 0000000077681970 5 bytes [49, C7, C2, 69, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlertResumeThread + 7 0000000077681977 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlertThread 0000000077681980 5 bytes [49, C7, C2, 6A, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlertThread + 7 0000000077681987 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateLocallyUniqueId 0000000077681990 5 bytes [49, C7, C2, 6B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateLocallyUniqueId + 7 0000000077681997 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateReserveObject 00000000776819a0 5 bytes [49, C7, C2, 6C, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateReserveObject + 7 00000000776819a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUserPhysicalPages 00000000776819b0 5 bytes [49, C7, C2, 6D, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUserPhysicalPages + 7 00000000776819b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUuids 00000000776819c0 5 bytes [49, C7, C2, 6E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateUuids + 7 00000000776819c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcAcceptConnectPort 00000000776819d0 5 bytes [49, C7, C2, 6F, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcAcceptConnectPort + 7 00000000776819d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCancelMessage 00000000776819e0 5 bytes [49, C7, C2, 70, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCancelMessage + 7 00000000776819e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00000000776819f0 5 bytes JMP 00000001750886d0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort + 7 00000000776819f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 0000000077681a00 5 bytes JMP 0000000175088520 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort + 7 0000000077681a07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePortSection 0000000077681a10 5 bytes [49, C7, C2, 73, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePortSection + 7 0000000077681a17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateResourceReserve 0000000077681a20 5 bytes [49, C7, C2, 74, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateResourceReserve + 7 0000000077681a27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSectionView 0000000077681a30 5 bytes [49, C7, C2, 75, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSectionView + 7 0000000077681a37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSecurityContext 0000000077681a40 5 bytes [49, C7, C2, 76, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreateSecurityContext + 7 0000000077681a47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeletePortSection 0000000077681a50 5 bytes [49, C7, C2, 77, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeletePortSection + 7 0000000077681a57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteResourceReserve 0000000077681a60 5 bytes [49, C7, C2, 78, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteResourceReserve + 7 0000000077681a67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSectionView 0000000077681a70 5 bytes [49, C7, C2, 79, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSectionView + 7 0000000077681a77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSecurityContext 0000000077681a80 5 bytes [49, C7, C2, 7A, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDeleteSecurityContext + 7 0000000077681a87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDisconnectPort 0000000077681a90 5 bytes [49, C7, C2, 7B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcDisconnectPort + 7 0000000077681a97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077681aa0 5 bytes JMP 0000000175086890 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort + 7 0000000077681aa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderProcess 0000000077681ab0 5 bytes [49, C7, C2, 7D, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderProcess + 7 0000000077681ab7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderThread 0000000077681ac0 5 bytes [49, C7, C2, 7E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcOpenSenderThread + 7 0000000077681ac7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformation 0000000077681ad0 5 bytes JMP 0000000175086520 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformation + 7 0000000077681ad7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformationMessage 0000000077681ae0 5 bytes JMP 0000000175086550 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcQueryInformationMessage + 7 0000000077681ae7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcRevokeSecurityContext 0000000077681af0 5 bytes [49, C7, C2, 81, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcRevokeSecurityContext + 7 0000000077681af7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000077681b00 5 bytes JMP 0000000175087100 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort + 7 0000000077681b07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSetInformation 0000000077681b10 5 bytes [49, C7, C2, 83, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSetInformation + 7 0000000077681b17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAreMappedFilesTheSame 0000000077681b20 5 bytes [49, C7, C2, 84, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAreMappedFilesTheSame + 7 0000000077681b27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000077681b30 5 bytes JMP 00000001750a2d00 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject + 7 0000000077681b37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFileEx 0000000077681b40 5 bytes [49, C7, C2, 86, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelIoFileEx + 7 0000000077681b47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelSynchronousIoFile 0000000077681b50 5 bytes [49, C7, C2, 87, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCancelSynchronousIoFile + 7 0000000077681b57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCommitComplete 0000000077681b60 5 bytes [49, C7, C2, 88, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCommitComplete + 7 0000000077681b67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCommitEnlistment 0000000077681b70 5 bytes [49, C7, C2, 89, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCommitEnlistment + 7 0000000077681b77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCommitTransaction 0000000077681b80 5 bytes [49, C7, C2, 8A, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCommitTransaction + 7 0000000077681b87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompactKeys 0000000077681b90 5 bytes [49, C7, C2, 8B, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompactKeys + 7 0000000077681b97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompareTokens 0000000077681ba0 5 bytes [49, C7, C2, 8C, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompareTokens + 7 0000000077681ba7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompleteConnectPort 0000000077681bb0 5 bytes [49, C7, C2, 8D, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompleteConnectPort + 7 0000000077681bb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompressKey 0000000077681bc0 5 bytes [49, C7, C2, 8E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCompressKey + 7 0000000077681bc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 0000000077681bd0 5 bytes JMP 0000000175087f10 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort + 7 0000000077681bd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDebugObject 0000000077681be0 5 bytes [49, C7, C2, 90, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDebugObject + 7 0000000077681be7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDirectoryObject 0000000077681bf0 5 bytes [49, C7, C2, 91, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateDirectoryObject + 7 0000000077681bf7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEnlistment 0000000077681c00 5 bytes [49, C7, C2, 92, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEnlistment + 7 0000000077681c07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000077681c10 5 bytes [49, C7, C2, 93, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair + 7 0000000077681c17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000077681c20 5 bytes [49, C7, C2, 94, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion + 7 0000000077681c27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobObject 0000000077681c30 5 bytes JMP 00000001750a29d0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobObject + 7 0000000077681c37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobSet 0000000077681c40 5 bytes [49, C7, C2, 96, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateJobSet + 7 0000000077681c47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyTransacted 0000000077681c50 5 bytes [49, C7, C2, 97, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyTransacted + 7 0000000077681c57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyedEvent 0000000077681c60 5 bytes [49, C7, C2, 98, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKeyedEvent + 7 0000000077681c67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMailslotFile 0000000077681c70 5 bytes JMP 000000017506fcc0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMailslotFile + 7 0000000077681c77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000077681c80 5 bytes JMP 00000001750893a0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 7 0000000077681c87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateNamedPipeFile 0000000077681c90 5 bytes JMP 000000017506fef0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateNamedPipeFile + 7 0000000077681c97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePagingFile 0000000077681ca0 5 bytes [49, C7, C2, 9C, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePagingFile + 7 0000000077681ca7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 0000000077681cb0 5 bytes JMP 0000000175087d10 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort + 7 0000000077681cb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePrivateNamespace 0000000077681cc0 5 bytes [49, C7, C2, 9E, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePrivateNamespace + 7 0000000077681cc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess 0000000077681cd0 5 bytes [49, C7, C2, 9F, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 7 0000000077681cd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfile 0000000077681ce0 5 bytes [49, C7, C2, A0, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfile + 7 0000000077681ce7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfileEx 0000000077681cf0 5 bytes [49, C7, C2, A1, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProfileEx + 7 0000000077681cf7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateResourceManager 0000000077681d00 5 bytes [49, C7, C2, A2, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateResourceManager + 7 0000000077681d07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000077681d10 5 bytes JMP 0000000175089760 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore + 7 0000000077681d17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 0000000077681d20 5 bytes [49, C7, C2, A4, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject + 7 0000000077681d27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077681d30 5 bytes [49, C7, C2, A5, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 7 0000000077681d37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000077681d40 5 bytes [49, C7, C2, A6, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer + 7 0000000077681d47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateToken 0000000077681d50 5 bytes [49, C7, C2, A7, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateToken + 7 0000000077681d57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransaction 0000000077681d60 5 bytes [49, C7, C2, A8, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransaction + 7 0000000077681d67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransactionManager 0000000077681d70 5 bytes [49, C7, C2, A9, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTransactionManager + 7 0000000077681d77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess 0000000077681d80 5 bytes [49, C7, C2, AA, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 7 0000000077681d87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWaitablePort 0000000077681d90 5 bytes [49, C7, C2, AB, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWaitablePort + 7 0000000077681d97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWorkerFactory 0000000077681da0 5 bytes [49, C7, C2, AC, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtCreateWorkerFactory + 7 0000000077681da7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000077681db0 5 bytes [49, C7, C2, AD, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess + 7 0000000077681db7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDebugContinue 0000000077681dc0 5 bytes [49, C7, C2, AE, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDebugContinue + 7 0000000077681dc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteAtom 0000000077681dd0 5 bytes [49, C7, C2, AF, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteAtom + 7 0000000077681dd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000077681de0 5 bytes [49, C7, C2, B0, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry + 7 0000000077681de7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteDriverEntry 0000000077681df0 5 bytes [49, C7, C2, B1, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteDriverEntry + 7 0000000077681df7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile 0000000077681e00 1 byte JMP 000000017506a190 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 2 0000000077681e02 3 bytes {JMP 0xfffffffffd9e8390} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey 0000000077681e10 5 bytes JMP 0000000175090fd0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 7 0000000077681e17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteObjectAuditAlarm 0000000077681e20 5 bytes [49, C7, C2, B4, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteObjectAuditAlarm + 7 0000000077681e27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeletePrivateNamespace 0000000077681e30 5 bytes [49, C7, C2, B5, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeletePrivateNamespace + 7 0000000077681e37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077681e40 5 bytes JMP 0000000175090e20 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 7 0000000077681e47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDisableLastKnownGood 0000000077681e50 5 bytes [49, C7, C2, B7, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDisableLastKnownGood + 7 0000000077681e57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDisplayString 0000000077681e60 3 bytes [49, C7, C2] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDisplayString + 4 0000000077681e64 1 byte [00] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDrawText 0000000077681e70 5 bytes [49, C7, C2, B9, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtDrawText + 7 0000000077681e77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnableLastKnownGood 0000000077681e80 5 bytes [49, C7, C2, BA, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnableLastKnownGood + 7 0000000077681e87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateBootEntries 0000000077681e90 5 bytes [49, C7, C2, BB, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateBootEntries + 7 0000000077681e97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateDriverEntries 0000000077681ea0 5 bytes [49, C7, C2, BC, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateDriverEntries + 7 0000000077681ea7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateSystemEnvironmentValuesEx 0000000077681eb0 5 bytes [49, C7, C2, BD, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateSystemEnvironmentValuesEx + 7 0000000077681eb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateTransactionObject 0000000077681ec0 5 bytes [49, C7, C2, BE, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtEnumerateTransactionObject + 7 0000000077681ec7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtExtendSection 0000000077681ed0 5 bytes [49, C7, C2, BF, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtExtendSection + 7 0000000077681ed7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFilterToken 0000000077681ee0 5 bytes [49, C7, C2, C0, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFilterToken + 7 0000000077681ee7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstallUILanguage 0000000077681ef0 5 bytes [49, C7, C2, C1, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstallUILanguage + 7 0000000077681ef7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstructionCache 0000000077681f00 5 bytes [49, C7, C2, C2, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushInstructionCache + 7 0000000077681f07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushKey 0000000077681f10 5 bytes [49, C7, C2, C3, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushKey + 7 0000000077681f17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushProcessWriteBuffers 0000000077681f20 5 bytes [49, C7, C2, C4, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushProcessWriteBuffers + 7 0000000077681f27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushVirtualMemory 0000000077681f30 5 bytes [49, C7, C2, C5, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushVirtualMemory + 7 0000000077681f37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushWriteBuffer 0000000077681f40 5 bytes [49, C7, C2, C6, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFlushWriteBuffer + 7 0000000077681f47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreeUserPhysicalPages 0000000077681f50 5 bytes [49, C7, C2, C7, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreeUserPhysicalPages + 7 0000000077681f57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeRegistry 0000000077681f60 5 bytes [49, C7, C2, C8, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeRegistry + 7 0000000077681f67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeTransactions 0000000077681f70 5 bytes [49, C7, C2, C9, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtFreezeTransactions + 7 0000000077681f77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077681f80 5 bytes [49, C7, C2, CA, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread + 7 0000000077681f87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetCurrentProcessorNumber 0000000077681f90 5 bytes [49, C7, C2, CB, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetCurrentProcessorNumber + 7 0000000077681f97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetDevicePowerState 0000000077681fa0 5 bytes [49, C7, C2, CC, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetDevicePowerState + 7 0000000077681fa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetMUIRegistryInfo 0000000077681fb0 5 bytes [49, C7, C2, CD, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetMUIRegistryInfo + 7 0000000077681fb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextProcess 0000000077681fc0 5 bytes [49, C7, C2, CE, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextProcess + 7 0000000077681fc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextThread 0000000077681fd0 5 bytes [49, C7, C2, CF, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNextThread + 7 0000000077681fd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNlsSectionPtr 0000000077681fe0 5 bytes [49, C7, C2, D0, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNlsSectionPtr + 7 0000000077681fe7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNotificationResourceManager 0000000077681ff0 5 bytes [49, C7, C2, D1, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetNotificationResourceManager + 7 0000000077681ff7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetPlugPlayEvent 0000000077682000 5 bytes [49, C7, C2, D2, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetPlugPlayEvent + 7 0000000077682007 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetWriteWatch 0000000077682010 5 bytes [49, C7, C2, D3, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtGetWriteWatch + 7 0000000077682017 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateAnonymousToken 0000000077682020 5 bytes JMP 00000001750868c0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateAnonymousToken + 7 0000000077682027 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateThread 0000000077682030 5 bytes JMP 0000000175086910 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateThread + 7 0000000077682037 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeNlsFiles 0000000077682040 5 bytes [49, C7, C2, D6, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeNlsFiles + 7 0000000077682047 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeRegistry 0000000077682050 5 bytes [49, C7, C2, D7, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtInitializeRegistry + 7 0000000077682057 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtInitiatePowerAction 0000000077682060 5 bytes [49, C7, C2, D8, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtInitiatePowerAction + 7 0000000077682067 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtIsSystemResumeAutomatic 0000000077682070 5 bytes [49, C7, C2, D9, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtIsSystemResumeAutomatic + 7 0000000077682077 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtIsUILanguageComitted 0000000077682080 5 bytes [49, C7, C2, DA, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtIsUILanguageComitted + 7 0000000077682087 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtListenPort 0000000077682090 5 bytes [49, C7, C2, DB, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtListenPort + 7 0000000077682097 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000776820a0 5 bytes JMP 00000001750922e0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 7 00000000776820a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey 00000000776820b0 5 bytes JMP 000000017508dac0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey + 7 00000000776820b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey2 00000000776820c0 5 bytes [49, C7, C2, DE, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKey2 + 7 00000000776820c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKeyEx 00000000776820d0 5 bytes [49, C7, C2, DF, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLoadKeyEx + 7 00000000776820d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockFile 00000000776820e0 5 bytes [49, C7, C2, E0, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockFile + 7 00000000776820e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockProductActivationKeys 00000000776820f0 5 bytes [49, C7, C2, E1, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockProductActivationKeys + 7 00000000776820f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockRegistryKey 0000000077682100 5 bytes [49, C7, C2, E2, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockRegistryKey + 7 0000000077682107 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockVirtualMemory 0000000077682110 5 bytes [49, C7, C2, E3, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtLockVirtualMemory + 7 0000000077682117 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMakePermanentObject 0000000077682120 5 bytes [49, C7, C2, E4, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMakePermanentObject + 7 0000000077682127 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 0000000077682130 5 bytes [49, C7, C2, E5, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject + 7 0000000077682137 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMapCMFModule 0000000077682140 5 bytes [49, C7, C2, E6, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMapCMFModule + 7 0000000077682147 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPages 0000000077682150 5 bytes [49, C7, C2, E7, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtMapUserPhysicalPages + 7 0000000077682157 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000077682160 5 bytes [49, C7, C2, E8, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry + 7 0000000077682167 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtModifyDriverEntry 0000000077682170 5 bytes [49, C7, C2, E9, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtModifyDriverEntry + 7 0000000077682177 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeDirectoryFile 0000000077682180 5 bytes [49, C7, C2, EA, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeDirectoryFile + 7 0000000077682187 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000077682190 5 bytes JMP 000000017508e750 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey + 7 0000000077682197 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000776821a0 5 bytes JMP 000000017508d520 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys + 7 00000000776821a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeSession 00000000776821b0 5 bytes [49, C7, C2, ED, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeSession + 7 00000000776821b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEnlistment 00000000776821c0 5 bytes [49, C7, C2, EE, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEnlistment + 7 00000000776821c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000776821d0 5 bytes [49, C7, C2, EF, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair + 7 00000000776821d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000776821e0 5 bytes [49, C7, C2, F0, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion + 7 00000000776821e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenJobObject 00000000776821f0 5 bytes [49, C7, C2, F1, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenJobObject + 7 00000000776821f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx 0000000077682200 5 bytes JMP 000000017508f8c0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 7 0000000077682207 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransacted 0000000077682210 5 bytes [49, C7, C2, F3, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransacted + 7 0000000077682217 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransactedEx 0000000077682220 5 bytes [49, C7, C2, F4, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyTransactedEx + 7 0000000077682227 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyedEvent 0000000077682230 5 bytes [49, C7, C2, F5, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyedEvent + 7 0000000077682237 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000077682240 5 bytes JMP 00000001750895b0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant + 7 0000000077682247 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenObjectAuditAlarm 0000000077682250 5 bytes [49, C7, C2, F7, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenObjectAuditAlarm + 7 0000000077682257 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenPrivateNamespace 0000000077682260 5 bytes [49, C7, C2, F8, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenPrivateNamespace + 7 0000000077682267 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000077682270 5 bytes [49, C7, C2, F9, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 7 0000000077682277 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenResourceManager 0000000077682280 5 bytes [49, C7, C2, FA, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenResourceManager + 7 0000000077682287 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000077682290 5 bytes JMP 00000001750899b0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore + 7 0000000077682297 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSession 00000000776822a0 5 bytes [49, C7, C2, FC, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSession + 7 00000000776822a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSymbolicLinkObject 00000000776822b0 5 bytes [49, C7, C2, FD, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSymbolicLinkObject + 7 00000000776822b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000776822c0 2 bytes JMP 000000017509f420 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 3 00000000776822c3 2 bytes [A1, FD] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000776822d0 5 bytes [49, C7, C2, FF, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer + 7 00000000776822d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransaction 00000000776822e0 6 bytes [49, C7, C2, 00, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransaction + 7 00000000776822e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransactionManager 00000000776822f0 4 bytes [49, C7, C2, 01] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTransactionManager + 5 00000000776822f5 1 byte [00] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPlugPlayControl 0000000077682300 6 bytes [49, C7, C2, 02, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPlugPlayControl + 7 0000000077682307 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareComplete 0000000077682310 6 bytes [49, C7, C2, 03, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareComplete + 7 0000000077682317 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareEnlistment 0000000077682320 6 bytes [49, C7, C2, 04, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrePrepareEnlistment + 7 0000000077682327 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareComplete 0000000077682330 6 bytes [49, C7, C2, 05, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareComplete + 7 0000000077682337 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareEnlistment 0000000077682340 6 bytes [49, C7, C2, 06, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrepareEnlistment + 7 0000000077682347 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeCheck 0000000077682350 6 bytes [49, C7, C2, 07, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeCheck + 7 0000000077682357 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeObjectAuditAlarm 0000000077682360 6 bytes [49, C7, C2, 08, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegeObjectAuditAlarm + 7 0000000077682367 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegedServiceAuditAlarm 0000000077682370 6 bytes [49, C7, C2, 09, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPrivilegedServiceAuditAlarm + 7 0000000077682377 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationComplete 0000000077682380 6 bytes [49, C7, C2, 0A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationComplete + 7 0000000077682387 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationFailed 0000000077682390 6 bytes [49, C7, C2, 0B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPropagationFailed + 7 0000000077682397 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPulseEvent 00000000776823a0 6 bytes [49, C7, C2, 0C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtPulseEvent + 7 00000000776823a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootEntryOrder 00000000776823b0 6 bytes [49, C7, C2, 0D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootEntryOrder + 7 00000000776823b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootOptions 00000000776823c0 6 bytes [49, C7, C2, 0E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryBootOptions + 7 00000000776823c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDebugFilterState 00000000776823d0 6 bytes [49, C7, C2, 0F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDebugFilterState + 7 00000000776823d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryObject 00000000776823e0 6 bytes [49, C7, C2, 10, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryObject + 7 00000000776823e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDriverEntryOrder 00000000776823f0 6 bytes [49, C7, C2, 11, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDriverEntryOrder + 7 00000000776823f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEaFile 0000000077682400 6 bytes [49, C7, C2, 12, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryEaFile + 7 0000000077682407 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000077682410 6 bytes JMP 0000000175072400 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 7 0000000077682417 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationAtom 0000000077682420 6 bytes [49, C7, C2, 14, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationAtom + 7 0000000077682427 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationEnlistment 0000000077682430 6 bytes [49, C7, C2, 15, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationEnlistment + 7 0000000077682437 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationJobObject 0000000077682440 6 bytes [49, C7, C2, 16, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationJobObject + 7 0000000077682447 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationPort 0000000077682450 6 bytes [49, C7, C2, 17, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationPort + 7 0000000077682457 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationResourceManager 0000000077682460 6 bytes [49, C7, C2, 18, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationResourceManager + 7 0000000077682467 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransaction 0000000077682470 6 bytes [49, C7, C2, 19, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransaction + 7 0000000077682477 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransactionManager 0000000077682480 6 bytes [49, C7, C2, 1A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationTransactionManager + 7 0000000077682487 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationWorkerFactory 0000000077682490 6 bytes [49, C7, C2, 1B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationWorkerFactory + 7 0000000077682497 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInstallUILanguage 00000000776824a0 6 bytes [49, C7, C2, 1C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInstallUILanguage + 7 00000000776824a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIntervalProfile 00000000776824b0 6 bytes [49, C7, C2, 1D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIntervalProfile + 7 00000000776824b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIoCompletion 00000000776824c0 6 bytes [49, C7, C2, 1E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryIoCompletion + 7 00000000776824c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryLicenseValue 00000000776824d0 6 bytes [49, C7, C2, 1F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryLicenseValue + 7 00000000776824d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMultipleValueKey 00000000776824e0 6 bytes JMP 0000000175090830 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMultipleValueKey + 7 00000000776824e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMutant 00000000776824f0 6 bytes [49, C7, C2, 21, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryMutant + 7 00000000776824f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeys 0000000077682500 6 bytes [49, C7, C2, 22, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeys + 7 0000000077682507 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeysEx 0000000077682510 6 bytes [49, C7, C2, 23, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryOpenSubKeysEx + 7 0000000077682517 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPortInformationProcess 0000000077682520 6 bytes [49, C7, C2, 24, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryPortInformationProcess + 7 0000000077682527 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryQuotaInformationFile 0000000077682530 6 bytes [49, C7, C2, 25, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryQuotaInformationFile + 7 0000000077682537 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityAttributesToken 0000000077682540 6 bytes [49, C7, C2, 26, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityAttributesToken + 7 0000000077682547 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityObject 0000000077682550 6 bytes JMP 000000017509f4a0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySecurityObject + 7 0000000077682557 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySemaphore 0000000077682560 6 bytes [49, C7, C2, 28, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySemaphore + 7 0000000077682567 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySymbolicLinkObject 0000000077682570 6 bytes [49, C7, C2, 29, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySymbolicLinkObject + 7 0000000077682577 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValue 0000000077682580 6 bytes [49, C7, C2, 2A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValue + 7 0000000077682587 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValueEx 0000000077682590 6 bytes [49, C7, C2, 2B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemEnvironmentValueEx + 7 0000000077682597 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformationEx 00000000776825a0 6 bytes [49, C7, C2, 2C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQuerySystemInformationEx + 7 00000000776825a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimerResolution 00000000776825b0 6 bytes [49, C7, C2, 2D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueryTimerResolution + 7 00000000776825b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000776825c0 6 bytes [49, C7, C2, 2E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx + 7 00000000776825c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError 00000000776825e0 6 bytes [49, C7, C2, 30, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRaiseHardError + 7 00000000776825e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadOnlyEnlistment 00000000776825f0 6 bytes [49, C7, C2, 31, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReadOnlyEnlistment + 7 00000000776825f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverEnlistment 0000000077682600 6 bytes [49, C7, C2, 32, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverEnlistment + 7 0000000077682607 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverResourceManager 0000000077682610 6 bytes [49, C7, C2, 33, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverResourceManager + 7 0000000077682617 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverTransactionManager 0000000077682620 6 bytes [49, C7, C2, 34, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRecoverTransactionManager + 7 0000000077682627 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterProtocolAddressInformation 0000000077682630 6 bytes [49, C7, C2, 35, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterProtocolAddressInformation + 7 0000000077682637 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterThreadTerminatePort 0000000077682640 6 bytes [49, C7, C2, 36, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRegisterThreadTerminatePort + 7 0000000077682647 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseKeyedEvent 0000000077682650 6 bytes [49, C7, C2, 37, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseKeyedEvent + 7 0000000077682657 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseWorkerFactoryWorker 0000000077682660 6 bytes [49, C7, C2, 38, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReleaseWorkerFactoryWorker + 7 0000000077682667 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletionEx 0000000077682670 6 bytes [49, C7, C2, 39, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveIoCompletionEx + 7 0000000077682677 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveProcessDebug 0000000077682680 6 bytes [49, C7, C2, 3A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRemoveProcessDebug + 7 0000000077682687 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey 0000000077682690 6 bytes JMP 000000017508da70 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey + 7 0000000077682697 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRenameTransactionManager 00000000776826a0 6 bytes [49, C7, C2, 3C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRenameTransactionManager + 7 00000000776826a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplaceKey 00000000776826b0 6 bytes [49, C7, C2, 3D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplaceKey + 7 00000000776826b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplacePartitionUnit 00000000776826c0 6 bytes [49, C7, C2, 3E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplacePartitionUnit + 7 00000000776826c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReplyPort 00000000776826d0 6 bytes [49, C7, C2, 3F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReplyPort + 7 00000000776826d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRequestPort 00000000776826e0 6 bytes [49, C7, C2, 40, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRequestPort + 7 00000000776826e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResetEvent 00000000776826f0 6 bytes [49, C7, C2, 41, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResetEvent + 7 00000000776826f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResetWriteWatch 0000000077682700 6 bytes [49, C7, C2, 42, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResetWriteWatch + 7 0000000077682707 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRestoreKey 0000000077682710 6 bytes [49, C7, C2, 43, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRestoreKey + 7 0000000077682717 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000077682720 6 bytes [49, C7, C2, 44, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess + 7 0000000077682727 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackComplete 0000000077682730 6 bytes [49, C7, C2, 45, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackComplete + 7 0000000077682737 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackEnlistment 0000000077682740 6 bytes [49, C7, C2, 46, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackEnlistment + 7 0000000077682747 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackTransaction 0000000077682750 6 bytes [49, C7, C2, 47, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollbackTransaction + 7 0000000077682757 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollforwardTransactionManager 0000000077682760 6 bytes [49, C7, C2, 48, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtRollforwardTransactionManager + 7 0000000077682767 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKey 0000000077682770 1 byte JMP 0000000175098f00 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKey + 2 0000000077682772 4 bytes {JMP 0xfffffffffda16790} .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKeyEx 0000000077682780 6 bytes [49, C7, C2, 4A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSaveKeyEx + 7 0000000077682787 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSaveMergedKeys 0000000077682790 6 bytes [49, C7, C2, 4B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSaveMergedKeys + 7 0000000077682797 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSecureConnectPort 00000000776827a0 6 bytes JMP 00000001750881a0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSecureConnectPort + 7 00000000776827a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSerializeBoot 00000000776827b0 6 bytes [49, C7, C2, 4D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSerializeBoot + 7 00000000776827b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000776827c0 6 bytes [49, C7, C2, 4E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder + 7 00000000776827c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000776827d0 6 bytes [49, C7, C2, 4F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions + 7 00000000776827d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000776827e0 6 bytes [49, C7, C2, 50, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread + 7 00000000776827e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDebugFilterState 00000000776827f0 6 bytes [49, C7, C2, 51, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDebugFilterState + 7 00000000776827f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultHardErrorPort 0000000077682800 6 bytes [49, C7, C2, 52, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultHardErrorPort + 7 0000000077682807 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultLocale 0000000077682810 6 bytes [49, C7, C2, 53, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultLocale + 7 0000000077682817 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultUILanguage 0000000077682820 6 bytes [49, C7, C2, 54, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDefaultUILanguage + 7 0000000077682827 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDriverEntryOrder 0000000077682830 6 bytes [49, C7, C2, 55, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetDriverEntryOrder + 7 0000000077682837 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetEaFile 0000000077682840 6 bytes [49, C7, C2, 56, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetEaFile + 7 0000000077682847 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighEventPair 0000000077682850 6 bytes [49, C7, C2, 57, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighEventPair + 7 0000000077682857 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighWaitLowEventPair 0000000077682860 6 bytes [49, C7, C2, 58, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetHighWaitLowEventPair + 7 0000000077682867 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationDebugObject 0000000077682870 6 bytes [49, C7, C2, 59, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationDebugObject + 7 0000000077682877 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationEnlistment 0000000077682880 6 bytes [49, C7, C2, 5A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationEnlistment + 7 0000000077682887 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationJobObject 0000000077682890 6 bytes JMP 00000001750a2d50 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationJobObject + 7 0000000077682897 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationKey 00000000776828a0 6 bytes [49, C7, C2, 5C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationKey + 7 00000000776828a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationResourceManager 00000000776828b0 6 bytes [49, C7, C2, 5D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationResourceManager + 7 00000000776828b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationToken 00000000776828c0 6 bytes JMP 000000017509f7d0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationToken + 7 00000000776828c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransaction 00000000776828d0 6 bytes [49, C7, C2, 5F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransaction + 7 00000000776828d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransactionManager 00000000776828e0 6 bytes [49, C7, C2, 60, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationTransactionManager + 7 00000000776828e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationWorkerFactory 00000000776828f0 6 bytes [49, C7, C2, 61, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationWorkerFactory + 7 00000000776828f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetIntervalProfile 0000000077682900 6 bytes [49, C7, C2, 62, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetIntervalProfile + 7 0000000077682907 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletion 0000000077682910 6 bytes [49, C7, C2, 63, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletion + 7 0000000077682917 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletionEx 0000000077682920 6 bytes [49, C7, C2, 64, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetIoCompletionEx + 7 0000000077682927 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetLdtEntries 0000000077682930 6 bytes [49, C7, C2, 65, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetLdtEntries + 7 0000000077682937 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowEventPair 0000000077682940 6 bytes [49, C7, C2, 66, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowEventPair + 7 0000000077682947 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowWaitHighEventPair 0000000077682950 6 bytes [49, C7, C2, 67, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetLowWaitHighEventPair + 7 0000000077682957 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetQuotaInformationFile 0000000077682960 6 bytes [49, C7, C2, 68, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetQuotaInformationFile + 7 0000000077682967 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 0000000077682970 6 bytes JMP 000000017509f5d0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject + 7 0000000077682977 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValue 0000000077682980 6 bytes [49, C7, C2, 6A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValue + 7 0000000077682987 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValueEx 0000000077682990 6 bytes [49, C7, C2, 6B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemEnvironmentValueEx + 7 0000000077682997 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000776829a0 6 bytes [49, C7, C2, 6C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 7 00000000776829a7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000776829b0 6 bytes [49, C7, C2, 6D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState + 7 00000000776829b7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemTime 00000000776829c0 6 bytes [49, C7, C2, 6E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemTime + 7 00000000776829c7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetThreadExecutionState 00000000776829d0 6 bytes [49, C7, C2, 6F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetThreadExecutionState + 7 00000000776829d7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerEx 00000000776829e0 6 bytes [49, C7, C2, 70, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerEx + 7 00000000776829e7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerResolution 00000000776829f0 6 bytes [49, C7, C2, 71, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetTimerResolution + 7 00000000776829f7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetUuidSeed 0000000077682a00 6 bytes [49, C7, C2, 72, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetUuidSeed + 7 0000000077682a07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetVolumeInformationFile 0000000077682a10 6 bytes [49, C7, C2, 73, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSetVolumeInformationFile + 7 0000000077682a17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000077682a20 6 bytes [49, C7, C2, 74, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem + 7 0000000077682a27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownWorkerFactory 0000000077682a30 6 bytes [49, C7, C2, 75, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownWorkerFactory + 7 0000000077682a37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSignalAndWaitForSingleObject 0000000077682a40 6 bytes [49, C7, C2, 76, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSignalAndWaitForSingleObject + 7 0000000077682a47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSinglePhaseReject 0000000077682a50 6 bytes [49, C7, C2, 77, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSinglePhaseReject + 7 0000000077682a57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtStartProfile 0000000077682a60 6 bytes [49, C7, C2, 78, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtStartProfile + 7 0000000077682a67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtStopProfile 0000000077682a70 6 bytes [49, C7, C2, 79, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtStopProfile + 7 0000000077682a77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000077682a80 6 bytes [49, C7, C2, 7A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 7 0000000077682a87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000077682a90 6 bytes [49, C7, C2, 7B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread + 7 0000000077682a97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000077682aa0 6 bytes [49, C7, C2, 7C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 7 0000000077682aa7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTestAlert 0000000077682ac0 6 bytes [49, C7, C2, 7E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTestAlert + 7 0000000077682ac7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtThawRegistry 0000000077682ad0 6 bytes [49, C7, C2, 7F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtThawRegistry + 7 0000000077682ad7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtThawTransactions 0000000077682ae0 6 bytes [49, C7, C2, 80, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtThawTransactions + 7 0000000077682ae7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTraceControl 0000000077682af0 6 bytes [49, C7, C2, 81, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTraceControl + 7 0000000077682af7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTranslateFilePath 0000000077682b00 6 bytes [49, C7, C2, 82, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtTranslateFilePath + 7 0000000077682b07 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUmsThreadYield 0000000077682b10 6 bytes [49, C7, C2, 83, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUmsThreadYield + 7 0000000077682b17 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadDriver 0000000077682b20 6 bytes [49, C7, C2, 84, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadDriver + 7 0000000077682b27 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey 0000000077682b30 6 bytes [49, C7, C2, 85, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey + 7 0000000077682b37 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey2 0000000077682b40 6 bytes [49, C7, C2, 86, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKey2 + 7 0000000077682b47 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKeyEx 0000000077682b50 6 bytes [49, C7, C2, 87, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnloadKeyEx + 7 0000000077682b57 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockFile 0000000077682b60 6 bytes [49, C7, C2, 88, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockFile + 7 0000000077682b67 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockVirtualMemory 0000000077682b70 6 bytes [49, C7, C2, 89, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtUnlockVirtualMemory + 7 0000000077682b77 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000077682b80 6 bytes [49, C7, C2, 8A, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 7 0000000077682b87 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForDebugEvent 0000000077682b90 6 bytes [49, C7, C2, 8B, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForDebugEvent + 7 0000000077682b97 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForKeyedEvent 0000000077682ba0 6 bytes [49, C7, C2, 8C, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForKeyedEvent + 7 0000000077682ba7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForWorkViaWorkerFactory 0000000077682bb0 6 bytes [49, C7, C2, 8D, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitForWorkViaWorkerFactory + 7 0000000077682bb7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitHighEventPair 0000000077682bc0 6 bytes [49, C7, C2, 8E, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitHighEventPair + 7 0000000077682bc7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitLowEventPair 0000000077682bd0 6 bytes [49, C7, C2, 8F, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWaitLowEventPair + 7 0000000077682bd7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWorkerFactoryWorkerReady 0000000077682be0 6 bytes [49, C7, C2, 90, 01, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!NtWorkerFactoryWorkerReady + 7 0000000077682be7 5 bytes JMP 00000000777e0060 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\ntdll.dll!RtlGetFullPathName_UEx 0000000077686940 5 bytes JMP 0000000175071680 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\KERNELBASE.dll!GetFinalPathNameByHandleW + 1 000007fefd678c71 7 bytes [B8, 70, 5E, 07, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\KERNELBASE.dll!GetFinalPathNameByHandleW + 10 000007fefd678c7a 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\KERNELBASE.dll!DefineDosDeviceW + 1 000007fefd6a0c11 11 bytes {MOV EAX, 0x750a28a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!EnumDependentServicesW + 1 000007feff781461 11 bytes {MOV EAX, 0x75098820; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!QueryServiceStatusEx + 1 000007feff789415 11 bytes {MOV EAX, 0x7509b5b0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!AccessCheckByType 000007feff78a280 12 bytes {MOV RAX, 0xdf191c; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryW + 1 000007feff78aac1 11 bytes {MOV EAX, 0x7505a8e0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusExW 000007feff78eac0 12 bytes {MOV RAX, 0x7509d6a0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!ReportEventW 000007feff78fff0 12 bytes {MOV RAX, 0x750777f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!LookupAccountNameW + 1 000007feff790ac5 11 bytes {MOV EAX, 0x7505a7a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!RegisterEventSourceW 000007feff795fe0 12 bytes {MOV RAX, 0x75098d50; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!DeregisterEventSource + 1 000007feff79a541 5 bytes [B8, F0, 77, 07, 75] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!DeregisterEventSource + 9 000007feff79a549 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetTokenInformation + 1 000007feff79e051 11 bytes {MOV EAX, 0xdf1a20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007feff7a55c8 11 bytes [48, B8, A0, D7, 09, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameW + 1 000007feff7a5721 11 bytes {MOV EAX, 0x7509be10; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameW + 1 000007feff7a57f1 11 bytes {MOV EAX, 0x7509bfe0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!RegisterEventSourceA 000007feff7a74e0 12 bytes {MOV RAX, 0x75098d80; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!QueryServiceObjectSecurity + 1 000007feff7bb3bd 11 bytes {MOV EAX, 0x7509a080; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!QueryServiceConfig2W + 1 000007feff7bb3f1 11 bytes {MOV EAX, 0x7509bb70; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!QueryServiceConfig2A + 1 000007feff7bb411 11 bytes {MOV EAX, 0x7509bc60; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007feff7bb85c 11 bytes [48, B8, B0, DA, 09, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW 000007feff7bb9d0 12 bytes {MOV RAX, 0x7509c2f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA 000007feff7bba3c 12 bytes {MOV RAX, 0x7509c5f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredRenameA + 1 000007feff7c2c71 5 bytes [B8, 30, 0A, 06, 75] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredRenameA + 9 000007feff7c2c79 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetEffectiveRightsFromAclW + 1 000007feff7c59e1 11 bytes {MOV EAX, 0x7505aa40; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!EnumDependentServicesA + 1 000007feff7cd091 11 bytes {MOV EAX, 0x75098820; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusExA 000007feff7cd200 12 bytes {MOV RAX, 0x7509d720; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusA 000007feff7cd400 12 bytes {MOV RAX, 0x7509d650; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!EnumServicesStatusW 000007feff7cd800 12 bytes {MOV RAX, 0x7509d5f0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!UnlockServiceDatabase + 1 000007feff7cd851 11 bytes {MOV EAX, 0x75098890; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!QueryServiceLockStatusW 000007feff7cd8c0 12 bytes {MOV RAX, 0x750987d0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!QueryServiceLockStatusA 000007feff7cd9d0 12 bytes {MOV RAX, 0x750987d0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!LockServiceDatabase + 1 000007feff7cdae1 8 bytes [B8, 50, 88, 09, 75, 00, 00, ...] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!LockServiceDatabase + 10 000007feff7cdaea 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameA + 1 000007feff7cdb61 7 bytes [B8, E0, BE, 09, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetServiceDisplayNameA + 9 000007feff7cdb69 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameA + 1 000007feff7cdbf1 7 bytes [B8, 50, C1, 09, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!GetServiceKeyNameA + 9 000007feff7cdbf9 3 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredDeleteW + 1 000007feff7e0831 11 bytes {MOV EAX, 0x75060690; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredDeleteA + 1 000007feff7e08f1 11 bytes {MOV EAX, 0x75060af0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!ReportEventA + 1 000007feff7e1be1 11 bytes {MOV EAX, 0x750777f0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryA 000007feff7ec780 10 bytes [48, B8, A0, A8, 05, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!RegConnectRegistryA + 11 000007feff7ec78b 1 byte {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredReadDomainCredentialsW + 1 000007feff7ed741 11 bytes {MOV EAX, 0x750604b0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredReadDomainCredentialsA + 1 000007feff7ed871 11 bytes {MOV EAX, 0x75060b90; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredWriteDomainCredentialsW + 1 000007feff7ed9a1 11 bytes {MOV EAX, 0x75060350; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredWriteDomainCredentialsA + 1 000007feff7eda81 11 bytes {MOV EAX, 0x75060a90; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredEnumerateW + 1 000007feff7edb81 11 bytes {MOV EAX, 0x75060700; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredEnumerateA + 1 000007feff7edcb1 11 bytes {MOV EAX, 0x75060c00; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredReadW + 1 000007feff7edde1 11 bytes {MOV EAX, 0x75060200; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredReadA + 1 000007feff7edef1 11 bytes {MOV EAX, 0x75060b20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredWriteW + 1 000007feff7ee001 11 bytes {MOV EAX, 0x75060130; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CredWriteA + 1 000007feff7ee0b1 11 bytes {MOV EAX, 0x75060a60; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ADVAPI32.dll!CreateProcessWithTokenW 000007feff7f0ba0 12 bytes {MOV RAX, 0x75095da0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!ControlService 000007feff32642c 5 bytes JMP 000007feff7a5668 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW 000007feff326484 5 bytes JMP 000007feff78e810 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!CloseServiceHandle 000007feff326518 5 bytes JMP 000007feff79adc4 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!OpenSCManagerW 000007feff32659c 5 bytes JMP 000007feff78e7f8 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!QueryServiceStatus 000007feff326730 5 bytes JMP 000007feff79615c .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!QueryServiceStatusEx 000007feff326784 5 bytes JMP 000007feff789414 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!StartServiceW 000007feff326824 5 bytes JMP 000007feff789400 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!SetServiceStatus 000007feff32687c 5 bytes JMP 000007feff788e34 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!OpenSCManagerA 000007feff326aa4 5 bytes JMP 000007feff79a320 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA 000007feff326c34 5 bytes JMP 000007feff79a30c .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!StartServiceA 000007feff326d00 5 bytes JMP 000007feff7bb320 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!QueryServiceObjectSecurity 000007feff326d58 5 bytes JMP 000007feff7bb3bc .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007feff326e00 5 bytes JMP 000007feff7bb32c .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007feff326f2c 5 bytes JMP 000007feff7bba3c .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007feff327220 5 bytes JMP 000007feff7bb9d0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007feff32739c 5 bytes JMP 000007feff7bbab4 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007feff327538 5 bytes JMP 000007feff7bbaa8 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007feff3275e8 5 bytes JMP 000007feff7bb85c .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007feff32790c 5 bytes JMP 000007feff7a55c8 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007feff327ab4 5 bytes JMP 000007feff7a5654 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfigA 000007feff327b04 5 bytes JMP 000007feff7bb3dc .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfigW 000007feff327c34 5 bytes JMP 000007feff78ec4c .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfig2A 000007feff327d78 5 bytes JMP 000007feff7bb410 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!QueryServiceConfig2W 000007feff328244 5 bytes JMP 000007feff7bb3f0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!StartServiceCtrlDispatcherA 000007feff3299e4 5 bytes JMP 000007feff7bb314 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!StartServiceCtrlDispatcherW 000007feff329ac8 5 bytes JMP 000007feff786e1c .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerW 000007feff32a51c 3 bytes JMP 000007feff782c18 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerW + 4 000007feff32a520 1 byte [00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerA 000007feff32a530 5 bytes JMP 000007feff7bb3b0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerExW 000007feff32a5b0 4 bytes JMP 000007feff788e00 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!RegisterServiceCtrlHandlerExA 000007feff32a5c4 5 bytes JMP 000007feff7bb3a4 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!NotifyServiceStatusChange 000007feff32bb28 5 bytes JMP 000007feff78d9b0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\SYSTEM32\sechost.dll!NotifyServiceStatusChangeA 000007feff32bb3c 5 bytes JMP 000007feff7a74c0 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\RPCRT4.dll!RpcBindingInqAuthClientExW + 1 000007feff535221 11 bytes {MOV EAX, 0x75096090; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\GDI32.dll!EnumFontFamiliesExW + 1 000007fefea18791 11 bytes {MOV EAX, 0x75077510; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\GDI32.dll!GdiAddFontResourceW 000007fefea1a104 12 bytes {MOV RAX, 0x75076d90; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\GDI32.dll!GdiDllInitialize + 1 000007fefea1aed1 11 bytes {MOV EAX, 0x75077260; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\GDI32.dll!RemoveFontResourceExW + 1 000007fefea24805 11 bytes {MOV EAX, 0x75076e30; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\GDI32.dll!GetFontResourceInfoW 000007fefea248c4 12 bytes {MOV RAX, 0x75076ed0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\GDI32.dll!EnumFontFamiliesExA + 1 000007fefea39085 11 bytes {MOV EAX, 0x750774a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\GDI32.dll!CreateScalableFontResourceW 000007fefea39ddc 12 bytes {MOV RAX, 0x75077000; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IMM32.DLL!ImmAssociateContext + 1 000007fefeb01751 11 bytes {MOV EAX, 0x750820b0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IMM32.DLL!ImmAssociateContextEx + 1 000007fefeb08241 3 bytes [B8, 60, 21] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IMM32.DLL!ImmAssociateContextEx + 5 000007fefeb08245 7 bytes [75, 00, 00, 00, 00, FF, E0] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\CRYPT32.dll!CertGetCertificateChain + 1 000007fefd4a1055 11 bytes {MOV EAX, 0x750614e0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\CRYPT32.dll!CryptUnprotectData 000007fefd4b93f8 12 bytes {MOV RAX, 0x75061090; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\CRYPT32.dll!CryptProtectData 000007fefd4b9914 12 bytes {MOV RAX, 0x750612c0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1 000007fefd82de91 11 bytes {MOV EAX, 0x7505edc0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefd847490 8 bytes [48, B8, 40, EC, 05, 75, 00, ...] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!CoCreateInstance + 10 000007fefd84749a 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!CoUnmarshalInterface 000007fefd84ea20 12 bytes {MOV RAX, 0x7505f2a0; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!CoMarshalInterface + 1 000007fefd84f1ad 11 bytes {MOV EAX, 0x7505c890; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!CoGetClassObject + 1 000007fefd852e19 11 bytes {MOV EAX, 0x7505ea20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!RevokeDragDrop + 1 000007fefd980c11 11 bytes {MOV EAX, 0x750a9f60; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!RegisterDragDrop + 1 000007fefd980d11 11 bytes {MOV EAX, 0x750a9ea0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\ole32.dll!CoGetObject 000007fefd983bd0 12 bytes {MOV RAX, 0x7505eb20; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\WS2_32.dll!connect 000007fefe9245c0 12 bytes {MOV RAX, 0x75092c80; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\WS2_32.dll!WSANSPIoctl + 1 000007fefe9444c1 11 bytes {MOV EAX, 0x75092b50; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\WS2_32.dll!WSAConnect + 1 000007fefe94e0f1 11 bytes {MOV EAX, 0x75092cf0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\SspiCli.dll!LsaRegisterLogonProcess 000007fefd239210 12 bytes {MOV RAX, 0x75092a30; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!CancelMibChangeNotify2 + 1 000007fefae86ff5 3 bytes [B8, E0, A8] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!CancelMibChangeNotify2 + 5 000007fefae86ff9 7 bytes [75, 00, 00, 00, 00, FF, E0] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!IcmpCloseHandle + 1 000007fefae87cc1 11 bytes {MOV EAX, 0x7508a7c0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!IcmpSendEcho2Ex 000007fefae87f5c 12 bytes {MOV RAX, 0x7508ac90; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!IcmpCreateFile + 1 000007fefae88251 3 bytes [B8, 00, A9] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!IcmpCreateFile + 5 000007fefae88255 5 bytes [75, 00, 00, 00, 00] .text ... * 2 .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!IcmpSendEcho 000007fefae88340 12 bytes {MOV RAX, 0x7508ab90; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!IcmpSendEcho2 + 1 000007fefae8839d 7 bytes [B8, 10, AC, 08, 75, 00, 00] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!IcmpSendEcho2 + 10 000007fefae883a6 2 bytes {JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!NotifyRouteChange2 + 1 000007fefae894b1 3 bytes [B8, 60, A8] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!NotifyRouteChange2 + 5 000007fefae894b5 7 bytes [75, 00, 00, 00, 00, FF, E0] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!Icmp6SendEcho2 000007fefae89ce0 12 bytes {MOV RAX, 0x7508ad20; JMP RAX} .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!Icmp6CreateFile + 1 000007fefae8a031 3 bytes [B8, 10, A9] .text C:\Program Files\Sandboxie\SandboxieCrypto.exe[3056] C:\Windows\system32\IPHLPAPI.DLL!Icmp6CreateFile + 5 000007fefae8a035 5 bytes [75, 00, 00, 00, 00] ---- EOF - GMER 2.1 ----