GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-10-19 10:07:08 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GB00 465,76GB Running: 5t9ds0ue.exe; Driver: C:\Users\UKASZ~1\AppData\Local\Temp\pxddapow.sys ---- User code sections - GMER 2.1 ---- .text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe[1564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe[1564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Lampy Lighty\updateLampyLighty.exe[2596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Lampy Lighty\bin\utilLampyLighty.exe[2640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe[256] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Steam\Steam.exe[5188] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe[5400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[5468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Probit Software\Easy Speed PC\ESPCSmartScan.exe[5624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[5360] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[1644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BOASHelper.exe[6072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[5324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe[2836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6084] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Browny02\BrYNSvc.exe[2316] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[6168] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6404] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[1248] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text c:\Program Files (x86)\Nero\Update\NASvc.exe[2524] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771f1465 2 bytes [1F, 77] .text C:\Program Files (x86)\Lampy Lighty\bin\LampyLighty.BrowserAdapter.exe[804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771f14bb 2 bytes [1F, 77] .text ... * 2 .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077ca11f5 8 bytes {JMP 0xd} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077ca1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077ca143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077ca158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077ca191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077ca1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077ca1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077ca1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077ca1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077ca1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077ca1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077ca1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077ca1fd7 8 bytes {JMP 0xb} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077ca2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077ca2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077ca2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077ca27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077ca27d2 8 bytes {JMP 0x10} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077ca282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077ca2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077ca2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077ca2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077ca3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077ca323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077ca33c0 16 bytes {JMP 0x4e} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077ca3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077ca3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077ca3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077ca3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077ca4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077cf1380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077cf1500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077cf1530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077cf1650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077cf1700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077cf1d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077cf1f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077cf27e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754e13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000754e146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754e16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754e16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754e19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754e19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000754e1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000754e1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000754e1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Łukasz\Desktop\diagnostyka\5t9ds0ue.exe[2740] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000754e1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] ---- Kernel IAT/EAT - GMER 2.1 ---- IAT C:\Windows\System32\win32k.sys[ntoskrnl.exe!KeUserModeCallback] [fffff880023bdec0] \SystemRoot\system32\DRIVERS\klif.sys [PAGE] ---- Processes - GMER 2.1 ---- Process C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [1352] (WindowsProtectManger Service/Fuyu LIMITED)(2014-10-17 19:10:45) 0000000000ad0000 ---- EOF - GMER 2.1 ----