GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-05-22 20:23:06 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST500LM0 rev.2AR1 465,76GB Running: n6unw4bh.exe; Driver: C:\Users\WINIAR~1\AppData\Local\Temp\fwddraog.sys ---- User code sections - GMER 2.1 ---- .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 000000014a4e0460 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 000000014a4e0450 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 000000014a4e0370 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 000000014a4e0470 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 000000014a4e03e0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 000000014a4e0320 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 000000014a4e03b0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 000000014a4e0390 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 000000014a4e02e0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 000000014a4e02d0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 000000014a4e0310 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 000000014a4e03c0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 000000014a4e03f0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 000000014a4e0230 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 000000014a4e0480 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 000000014a4e03a0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 000000014a4e02f0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 000000014a4e0350 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 000000014a4e0290 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 000000014a4e02b0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 000000014a4e03d0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 000000014a4e0330 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 000000014a4e0410 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 000000014a4e0240 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 000000014a4e01e0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 000000014a4e0250 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 000000014a4e0490 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 000000014a4e04a0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 000000014a4e0300 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 000000014a4e0360 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 000000014a4e02a0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 000000014a4e02c0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 000000014a4e0380 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 000000014a4e0340 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 000000014a4e0440 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 000000014a4e0260 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 000000014a4e0270 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 000000014a4e0400 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 000000014a4e01f0 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 000000014a4e0210 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 000000014a4e0200 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 000000014a4e0420 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 000000014a4e0430 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 000000014a4e0220 .text C:\windows\system32\csrss.exe[520] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 000000014a4e0280 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\wininit.exe[616] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 000000014a4e0460 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 000000014a4e0450 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 000000014a4e0370 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 000000014a4e0470 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 000000014a4e03e0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 000000014a4e0320 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 000000014a4e03b0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 000000014a4e0390 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 000000014a4e02e0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 000000014a4e02d0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 000000014a4e0310 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 000000014a4e03c0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 000000014a4e03f0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 000000014a4e0230 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 000000014a4e0480 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 000000014a4e03a0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 000000014a4e02f0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 000000014a4e0350 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 000000014a4e0290 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 000000014a4e02b0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 000000014a4e03d0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 000000014a4e0330 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 000000014a4e0410 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 000000014a4e0240 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 000000014a4e01e0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 000000014a4e0250 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 000000014a4e0490 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 000000014a4e04a0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 000000014a4e0300 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 000000014a4e0360 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 000000014a4e02a0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 000000014a4e02c0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 000000014a4e0380 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 000000014a4e0340 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 000000014a4e0440 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 000000014a4e0260 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 000000014a4e0270 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 000000014a4e0400 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 000000014a4e01f0 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 000000014a4e0210 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 000000014a4e0200 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 000000014a4e0420 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 000000014a4e0430 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 000000014a4e0220 .text C:\windows\system32\csrss.exe[628] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 000000014a4e0280 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\services.exe[664] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000100070460 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000100070450 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000100070370 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000100070470 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000001000703e0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000100070320 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000001000703b0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000100070390 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000001000702e0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000001000702d0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000100070310 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000001000703c0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000001000703f0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000100070230 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000100070480 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000001000703a0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000001000702f0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000100070350 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000100070290 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000001000702b0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000001000703d0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000100070330 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000100070410 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000100070240 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000001000701e0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000100070250 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000100070490 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000001000704a0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000100070300 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000100070360 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000001000702a0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000001000702c0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000100070380 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000100070340 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000100070440 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000100070260 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000100070270 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000100070400 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000001000701f0 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000100070210 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000100070200 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000100070420 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000100070430 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000100070220 .text C:\windows\system32\lsass.exe[700] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000100070280 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\lsm.exe[708] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\svchost.exe[824] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\nvvsvc.exe[904] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\winlogon.exe[928] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\svchost.exe[968] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\System32\svchost.exe[456] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\System32\svchost.exe[524] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\svchost.exe[840] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\AUDIODG.EXE[1116] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000100070460 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000100070450 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000100070370 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000100070470 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000001000703e0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000100070320 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000001000703b0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000100070390 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000001000702e0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000001000702d0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000100070310 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000001000703c0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000001000703f0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000100070230 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000100070480 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000001000703a0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000001000702f0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000100070350 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000100070290 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000001000702b0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000001000703d0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000100070330 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000100070410 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000100070240 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000001000701e0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000100070250 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000100070490 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000001000704a0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000100070300 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000100070360 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000001000702a0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000001000702c0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000100070380 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000100070340 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000100070440 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000100070260 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000100070270 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000100070400 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000001000701f0 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000100070210 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000100070200 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000100070420 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000100070430 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000100070220 .text C:\windows\system32\svchost.exe[1220] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000100070280 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\nvvsvc.exe[1256] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\Dwm.exe[1600] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\Explorer.EXE[1660] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1808] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\Windows\System32\rundll32.exe[1816] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\Program Files\Elantech\ETDCtrl.exe[1828] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[1840] C:\windows\syswow64\USER32.dll!GetMenu + 412 00000000752c51dd 7 bytes JMP 000000011003ac50 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[1840] C:\windows\syswow64\USER32.dll!PeekMessageA + 407 00000000752c610b 7 bytes JMP 000000011003b000 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[1840] C:\windows\syswow64\USER32.dll!CreateDialogIndirectParamW + 131 00000000752cc6c1 7 bytes JMP 000000011003abc0 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[1840] C:\windows\syswow64\USER32.dll!MessageBoxIndirectA + 199 000000007530fc98 7 bytes JMP 000000011003af50 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[1840] C:\windows\syswow64\USER32.dll!MessageBoxIndirectW + 52 000000007530fcd1 7 bytes JMP 000000011003adf0 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[1840] C:\windows\syswow64\USER32.dll!MessageBoxExA + 31 000000007530fcf5 7 bytes JMP 000000011003af00 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2012] C:\windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000750d8781 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075771401 2 bytes JMP 750fb21b C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075771419 2 bytes JMP 750fb346 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075771431 2 bytes JMP 75178f29 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007577144a 2 bytes CALL 750d489d C:\windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000757714dd 2 bytes JMP 75178822 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757714f5 2 bytes JMP 751789f8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007577150d 2 bytes JMP 75178718 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075771525 2 bytes JMP 75178ae2 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007577153d 2 bytes JMP 750efca8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075771555 2 bytes JMP 750f68ef C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007577156d 2 bytes JMP 75178fe3 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075771585 2 bytes JMP 75178b42 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007577159d 2 bytes JMP 751786dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000757715b5 2 bytes JMP 750efd41 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000757715cd 2 bytes JMP 750fb2dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000757716b2 2 bytes JMP 75178ea4 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[608] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000757716bd 2 bytes JMP 75178671 C:\windows\syswow64\kernel32.dll .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\System32\spoolsv.exe[1324] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\taskhost.exe[1796] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\svchost.exe[2284] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[2828] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[2444] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\System32\svchost.exe[548] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075771401 2 bytes JMP 750fb21b C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075771419 2 bytes JMP 750fb346 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075771431 2 bytes JMP 75178f29 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007577144a 2 bytes CALL 750d489d C:\windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000757714dd 2 bytes JMP 75178822 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757714f5 2 bytes JMP 751789f8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007577150d 2 bytes JMP 75178718 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075771525 2 bytes JMP 75178ae2 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007577153d 2 bytes JMP 750efca8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075771555 2 bytes JMP 750f68ef C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007577156d 2 bytes JMP 75178fe3 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075771585 2 bytes JMP 75178b42 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007577159d 2 bytes JMP 751786dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000757715b5 2 bytes JMP 750efd41 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000757715cd 2 bytes JMP 750fb2dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000757716b2 2 bytes JMP 75178ea4 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3156] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000757716bd 2 bytes JMP 75178671 C:\windows\syswow64\kernel32.dll .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\svchost.exe[3664] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\igfxsrvc.exe[4316] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075771401 2 bytes JMP 750fb21b C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075771419 2 bytes JMP 750fb346 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075771431 2 bytes JMP 75178f29 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007577144a 2 bytes CALL 750d489d C:\windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757714dd 2 bytes JMP 75178822 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757714f5 2 bytes JMP 751789f8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007577150d 2 bytes JMP 75178718 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075771525 2 bytes JMP 75178ae2 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007577153d 2 bytes JMP 750efca8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075771555 2 bytes JMP 750f68ef C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007577156d 2 bytes JMP 75178fe3 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075771585 2 bytes JMP 75178b42 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007577159d 2 bytes JMP 751786dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757715b5 2 bytes JMP 750efd41 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757715cd 2 bytes JMP 750fb2dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757716b2 2 bytes JMP 75178ea4 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4760] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757716bd 2 bytes JMP 75178671 C:\windows\syswow64\kernel32.dll .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\System32\svchost.exe[3236] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075771401 2 bytes JMP 750fb21b C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075771419 2 bytes JMP 750fb346 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075771431 2 bytes JMP 75178f29 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007577144a 2 bytes CALL 750d489d C:\windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757714dd 2 bytes JMP 75178822 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757714f5 2 bytes JMP 751789f8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007577150d 2 bytes JMP 75178718 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075771525 2 bytes JMP 75178ae2 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007577153d 2 bytes JMP 750efca8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075771555 2 bytes JMP 750f68ef C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007577156d 2 bytes JMP 75178fe3 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075771585 2 bytes JMP 75178b42 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007577159d 2 bytes JMP 751786dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757715b5 2 bytes JMP 750efd41 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757715cd 2 bytes JMP 750fb2dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757716b2 2 bytes JMP 75178ea4 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757716bd 2 bytes JMP 75178671 C:\windows\syswow64\kernel32.dll .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\SearchIndexer.exe[5248] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\taskeng.exe[5476] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\SearchProtocolHost.exe[5636] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\system32\taskeng.exe[5796] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075771401 2 bytes JMP 750fb21b C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075771419 2 bytes JMP 750fb346 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075771431 2 bytes JMP 75178f29 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007577144a 2 bytes CALL 750d489d C:\windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757714dd 2 bytes JMP 75178822 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757714f5 2 bytes JMP 751789f8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007577150d 2 bytes JMP 75178718 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075771525 2 bytes JMP 75178ae2 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007577153d 2 bytes JMP 750efca8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075771555 2 bytes JMP 750f68ef C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007577156d 2 bytes JMP 75178fe3 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075771585 2 bytes JMP 75178b42 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007577159d 2 bytes JMP 751786dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757715b5 2 bytes JMP 750efd41 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757715cd 2 bytes JMP 750fb2dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757716b2 2 bytes JMP 75178ea4 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4980] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757716bd 2 bytes JMP 75178671 C:\windows\syswow64\kernel32.dll .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\windows\System32\svchost.exe[5744] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000770cdc60 5 bytes JMP 0000000077230460 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000770cdcb0 5 bytes JMP 0000000077230450 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000770cde10 5 bytes JMP 0000000077230370 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000770cde60 5 bytes JMP 0000000077230470 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000770cde70 5 bytes JMP 00000000772303e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000770cdf20 5 bytes JMP 0000000077230320 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770cdf50 5 bytes JMP 00000000772303b0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000770cdf70 5 bytes JMP 0000000077230390 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000770cdfb0 5 bytes JMP 00000000772302e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000770ce030 5 bytes JMP 00000000772302d0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000770ce050 5 bytes JMP 0000000077230310 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000770ce090 5 bytes JMP 00000000772303c0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000770ce0e0 5 bytes JMP 00000000772303f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000770ce240 5 bytes JMP 0000000077230230 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000770ce400 5 bytes JMP 0000000077230480 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000770ce430 5 bytes JMP 00000000772303a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000770ce510 5 bytes JMP 00000000772302f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000770ce520 5 bytes JMP 0000000077230350 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000770ce580 5 bytes JMP 0000000077230290 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000770ce610 5 bytes JMP 00000000772302b0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000770ce630 5 bytes JMP 00000000772303d0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000770ce640 5 bytes JMP 0000000077230330 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000770ce6b0 5 bytes JMP 0000000077230410 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000770ce6e0 5 bytes JMP 0000000077230240 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000770ce9a0 5 bytes JMP 00000000772301e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000770cea60 5 bytes JMP 0000000077230250 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000770cea90 5 bytes JMP 0000000077230490 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000770ceaa0 5 bytes JMP 00000000772304a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000770cead0 5 bytes JMP 0000000077230300 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000770ceae0 5 bytes JMP 0000000077230360 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000770ceb40 5 bytes JMP 00000000772302a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000770ceb90 5 bytes JMP 00000000772302c0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000770cebc0 5 bytes JMP 0000000077230380 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000770cebd0 5 bytes JMP 0000000077230340 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000770ceec0 5 bytes JMP 0000000077230440 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000770cf0c0 5 bytes JMP 0000000077230260 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000770cf0d0 5 bytes JMP 0000000077230270 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000770cf0e0 5 bytes JMP 0000000077230400 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000770cf2a0 5 bytes JMP 00000000772301f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000770cf2b0 5 bytes JMP 0000000077230210 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000770cf320 5 bytes JMP 0000000077230200 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000770cf380 5 bytes JMP 0000000077230420 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000770cf390 5 bytes JMP 0000000077230430 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000770cf3a0 5 bytes JMP 0000000077230220 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[5772] C:\windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000770cf480 5 bytes JMP 0000000077230280 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002454f1df46 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749f59338f Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b8030594b2e9 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\dca9710db474 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002454f1df46 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749f59338f (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b8030594b2e9 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\dca9710db474 (not active ControlSet) ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----