GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-12 16:54:39 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GT10 465,76GB Running: bsug4upi.exe; Driver: C:\Users\euro\AppData\Local\Temp\kxliqpog.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000149b40460 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000149b40450 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000149b40370 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000149b40470 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 0000000149b403e0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000149b40320 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 0000000149b403b0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000149b40390 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 0000000149b402e0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 0000000149b402d0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000149b40310 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 0000000149b403c0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 0000000149b403f0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000149b40230 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000149b40480 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 0000000149b403a0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 0000000149b402f0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000149b40350 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000149b40290 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 0000000149b402b0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 0000000149b403d0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000149b40330 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000149b40410 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000149b40240 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 0000000149b401e0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000149b40250 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000149b40490 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 0000000149b404a0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000149b40300 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000149b40360 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 0000000149b402a0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 0000000149b402c0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000149b40380 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000149b40340 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000149b40440 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000149b40260 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000149b40270 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000149b40400 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 0000000149b401f0 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000149b40210 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000149b40200 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000149b40420 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000149b40430 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000149b40220 .text C:\Windows\system32\csrss.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000149b40280 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\wininit.exe[720] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000149b40460 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000149b40450 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000149b40370 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000149b40470 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 0000000149b403e0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000149b40320 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 0000000149b403b0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000149b40390 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 0000000149b402e0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 0000000149b402d0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000149b40310 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 0000000149b403c0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 0000000149b403f0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000149b40230 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000149b40480 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 0000000149b403a0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 0000000149b402f0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000149b40350 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000149b40290 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 0000000149b402b0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 0000000149b403d0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000149b40330 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000149b40410 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000149b40240 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 0000000149b401e0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000149b40250 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000149b40490 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 0000000149b404a0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000149b40300 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000149b40360 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 0000000149b402a0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 0000000149b402c0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000149b40380 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000149b40340 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000149b40440 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000149b40260 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000149b40270 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000149b40400 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 0000000149b401f0 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000149b40210 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000149b40200 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000149b40420 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000149b40430 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000149b40220 .text C:\Windows\system32\csrss.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000149b40280 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\services.exe[792] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\lsass.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\lsm.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\winlogon.exe[860] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\svchost.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\svchost.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\System32\svchost.exe[588] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\System32\svchost.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\svchost.exe[1092] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\svchost.exe[1372] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\WLANExt.exe[1456] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\atieclxx.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\taskeng.exe[1676] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\System32\spoolsv.exe[1728] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000100070460 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000100070450 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000100070370 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000100070470 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000001000703e0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000100070320 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000001000703b0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000100070390 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000001000702e0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000001000702d0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000100070310 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000001000703c0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000001000703f0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000100070230 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000100070480 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000001000703a0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000001000702f0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000100070350 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000100070290 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000001000702b0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000001000703d0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000100070330 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000100070410 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000100070240 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000001000701e0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000100070250 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000100070490 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000001000704a0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000100070300 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000100070360 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000001000702a0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000001000702c0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000100070380 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000100070400 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000100070200 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000100070420 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000100070430 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\svchost.exe[1756] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000100070280 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1916] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\taskhost.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\taskeng.exe[1520] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2144] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\Dwm.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000755e1401 2 bytes JMP 763db1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000755e1419 2 bytes JMP 763db31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000755e1431 2 bytes JMP 76458f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000755e144a 2 bytes CALL 763b4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755e14dd 2 bytes JMP 76458802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755e14f5 2 bytes JMP 764589d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000755e150d 2 bytes JMP 764586f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000755e1525 2 bytes JMP 76458ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000755e153d 2 bytes JMP 763cfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000755e1555 2 bytes JMP 763d68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000755e156d 2 bytes JMP 76458fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000755e1585 2 bytes JMP 76458b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000755e159d 2 bytes JMP 764586bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755e15b5 2 bytes JMP 763cfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755e15cd 2 bytes JMP 763db2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755e16b2 2 bytes JMP 76458e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2220] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755e16bd 2 bytes JMP 76458651 C:\Windows\syswow64\kernel32.dll .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\Explorer.EXE[2304] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000755e1401 2 bytes JMP 763db1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000755e1419 2 bytes JMP 763db31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000755e1431 2 bytes JMP 76458f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000755e144a 2 bytes CALL 763b4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755e14dd 2 bytes JMP 76458802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755e14f5 2 bytes JMP 764589d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000755e150d 2 bytes JMP 764586f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000755e1525 2 bytes JMP 76458ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000755e153d 2 bytes JMP 763cfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000755e1555 2 bytes JMP 763d68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000755e156d 2 bytes JMP 76458fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000755e1585 2 bytes JMP 76458b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000755e159d 2 bytes JMP 764586bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755e15b5 2 bytes JMP 763cfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755e15cd 2 bytes JMP 763db2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755e16b2 2 bytes JMP 76458e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755e16bd 2 bytes JMP 76458651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3168] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Sony\VAIO Smart Network\VSNService.exe[3392] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\svchost.exe[3756] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\DllHost.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4408] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4488] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4824] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\USER32.dll!GetMenu + 412 00000000755051dd 7 bytes JMP 000000011003b3d0 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\USER32.dll!PeekMessageA + 407 000000007550610b 7 bytes JMP 000000011003b780 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW + 131 000000007550c6c1 7 bytes JMP 000000011003b340 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA + 199 000000007554fc98 7 bytes JMP 000000011003b6d0 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW + 52 000000007554fcd1 7 bytes JMP 000000011003b570 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\USER32.dll!MessageBoxExA + 31 000000007554fcf5 7 bytes JMP 000000011003b680 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000755e1401 2 bytes JMP 763db1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000755e1419 2 bytes JMP 763db31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000755e1431 2 bytes JMP 76458f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000755e144a 2 bytes CALL 763b4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755e14dd 2 bytes JMP 76458802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755e14f5 2 bytes JMP 764589d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000755e150d 2 bytes JMP 764586f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000755e1525 2 bytes JMP 76458ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000755e153d 2 bytes JMP 763cfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000755e1555 2 bytes JMP 763d68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000755e156d 2 bytes JMP 76458fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000755e1585 2 bytes JMP 76458b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000755e159d 2 bytes JMP 764586bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755e15b5 2 bytes JMP 763cfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755e15cd 2 bytes JMP 763db2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755e16b2 2 bytes JMP 76458e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755e16bd 2 bytes JMP 76458651 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\system32\SearchIndexer.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\AVAST Software\Avast\avastui.exe[4668] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000763b8769 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5456] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[5900] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Sony\VAIO Care\VCPerfService.exe[2484] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000755e1401 2 bytes JMP 763db1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000755e1419 2 bytes JMP 763db31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000755e1431 2 bytes JMP 76458f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000755e144a 2 bytes CALL 763b4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755e14dd 2 bytes JMP 76458802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755e14f5 2 bytes JMP 764589d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000755e150d 2 bytes JMP 764586f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000755e1525 2 bytes JMP 76458ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000755e153d 2 bytes JMP 763cfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000755e1555 2 bytes JMP 763d68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000755e156d 2 bytes JMP 76458fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000755e1585 2 bytes JMP 76458b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000755e159d 2 bytes JMP 764586bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755e15b5 2 bytes JMP 763cfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755e15cd 2 bytes JMP 763db2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755e16b2 2 bytes JMP 76458e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[2832] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755e16bd 2 bytes JMP 76458651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Sony\VAIO Care\VCAgent.exe[1968] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\System32\vds.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Program Files\Sony\VAIO Update Common\VUAgent.exe[6308] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000100180460 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000100180450 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000100180370 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000100180470 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000001001803e0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000100180320 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000001001803b0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000100180390 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000001001802e0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000001001802d0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000100180310 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000001001803c0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000001001803f0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000100180230 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000100180480 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000001001803a0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000001001802f0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000100180350 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000100180290 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000001001802b0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000001001803d0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000100180330 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000100180410 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000100180240 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000001001801e0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000100180250 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000100180490 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000001001804a0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000100180300 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000100180360 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000001001802a0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000001001802c0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000100180380 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000100180340 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000100180440 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000100180260 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000100180270 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000100180400 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000001001801f0 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000100180210 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000100180200 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000100180420 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000100180430 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000100180220 .text C:\Program Files\Sony\VAIO Care\VCAdmin.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000100180280 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000775adc80 5 bytes JMP 0000000077710460 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000775adcd0 5 bytes JMP 0000000077710450 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000775ade30 5 bytes JMP 0000000077710370 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000775ade80 5 bytes JMP 0000000077710470 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775ade90 5 bytes JMP 00000000777103e0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000775adf40 5 bytes JMP 0000000077710320 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000775adf70 5 bytes JMP 00000000777103b0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000775adf90 5 bytes JMP 0000000077710390 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000775adfd0 5 bytes JMP 00000000777102e0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000775ae050 5 bytes JMP 00000000777102d0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000775ae070 5 bytes JMP 0000000077710310 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000775ae0b0 5 bytes JMP 00000000777103c0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000775ae100 5 bytes JMP 00000000777103f0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000775ae260 5 bytes JMP 0000000077710230 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000775ae420 5 bytes JMP 0000000077710480 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000775ae450 5 bytes JMP 00000000777103a0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000775ae530 5 bytes JMP 00000000777102f0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000775ae540 5 bytes JMP 0000000077710350 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000775ae5a0 5 bytes JMP 0000000077710290 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000775ae630 5 bytes JMP 00000000777102b0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000775ae650 5 bytes JMP 00000000777103d0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000775ae660 5 bytes JMP 0000000077710330 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000775ae6d0 5 bytes JMP 0000000077710410 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000775ae700 5 bytes JMP 0000000077710240 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000775ae9c0 5 bytes JMP 00000000777101e0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000775aea80 5 bytes JMP 0000000077710250 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000775aeab0 5 bytes JMP 0000000077710490 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000775aeac0 5 bytes JMP 00000000777104a0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000775aeaf0 5 bytes JMP 0000000077710300 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000775aeb00 5 bytes JMP 0000000077710360 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000775aeb60 5 bytes JMP 00000000777102a0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000775aebb0 5 bytes JMP 00000000777102c0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000775aebe0 5 bytes JMP 0000000077710380 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000775aebf0 5 bytes JMP 0000000077710340 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000775aeee0 5 bytes JMP 0000000077710440 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000775af0e0 5 bytes JMP 0000000077710260 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000775af0f0 5 bytes JMP 0000000077710270 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775af100 5 bytes JMP 0000000077710400 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000775af2c0 5 bytes JMP 00000000777101f0 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000775af2d0 5 bytes JMP 0000000077710210 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000775af340 5 bytes JMP 0000000077710200 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000775af3a0 5 bytes JMP 0000000077710420 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000775af3b0 5 bytes JMP 0000000077710430 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000775af3c0 5 bytes JMP 0000000077710220 .text C:\Windows\SYSTEM32\WISPTIS.EXE[6596] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000775af4a0 5 bytes JMP 0000000077710280 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\08edb9be64da Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\08edb9be64da@bccfcce69db4 0x69 0xE3 0x92 0xB0 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\08edb9be64da@c4420280ce7d 0xB5 0xEC 0xBC 0x61 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\08edb9be64da (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\08edb9be64da@bccfcce69db4 0x69 0xE3 0x92 0xB0 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\08edb9be64da@c4420280ce7d 0xB5 0xEC 0xBC 0x61 ... ---- EOF - GMER 2.1 ----